From the State Government edition of September 23, 2026
FPF finds 37 states introduced 124 chatbot bills in 2026 as laws shift from disclosures to interaction controls
Future of Privacy Forum (FPF) · Independent privacy/AI policy research (U.S. state legislation) · United States (multi-state)
- Publisher
- Future of Privacy Forum — Regulating the Conversation: The U.S. Landscape of AI Chatbot Legislation (R3 PDF)
- Original publication
- 2026-09
- Source retrieved
- 2026-09-24
What happened
Why now: FPF’s September 2026 report (methodology: bills tracked through September 2026) quantifies an active state chatbot-law wave—37 states introduced 124 chatbot-related bills in 2026, 13 enacted that year, totaling 18 enacted laws across 2025–2026—and documents a shift from early disclosure/crisis-referral rules toward regulating conversational UX (crisis protocols, minor safeguards, emotional-dependence and engagement-optimization limits, professional-licensure boundaries, data protections). Notes chatbot rules may preview agentic-AI governance. Complements same-week Oregon/Maryland frontier procurement moves by showing parallel state activity on conversational-AI product rules.
Why it matters
Cross-state legislative intelligence for SLED sellers and state counsel: clarifies that companion/youth chatbot statutes may or may not sweep ordinary government customer-service bots depending on definitions/carveouts—transferable caution when deploying resident assistants.
Evidence and measured results
FPF desk analysis of introduced/enacted bills; not an empirical study of chatbot harm rates. Companion-chatbot focus is primary; government FAQ bots may fall into carveouts depending on state definitions.
Limitations and uncertainty
publicationDate set to 2026-09-01 as month-level; exact day not stated on cover. Counts are FPF-tracked through September 2026 and may move. Report is not an audit of state agency systems.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-23; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Multi-state AI assistants face a fast-changing chatbot statute patchwork that may treat companion features differently from service FAQs.
- Stakeholders
- State CIO / counsel
- Privacy officer
- Product owner for resident assistants
- Vendor compliance
- Discovery questions
- Which definitional model does each target state use?
- Do our bots retain memory or emotional prompts?
- What carveouts cover government customer service?
- Who monitors new enactments monthly?
- Value hypothesis
- A bounded multi-state chatbot-law matrix engagement reduces surprise compliance blockers before scale-out.
- Potential engagement
- 3–5 week jurisdiction matrix and product-behavior mapping against FPF categories.
- Unsupported claims
- FPF counts equal enforcement outcomes
- All government chatbots are exempt
- Agentic rules already enacted uniformly
Pre-sales engineering
Role takeaway
- Fit
- Fit for compliance feature-flag architecture and logging; unfit as a substitute for jurisdiction-specific legal advice.
- Architecture and integration
- Per-state policy packs for disclosures/crisis/minors; narrow-purpose FAQ mode; memory/personalization switches.
- Prerequisites
- Bill tracker feed
- Product behavior inventory
- Legal review channel
- Logging for high-risk chats
- Constraints
- Companion-focused statutes may not map 1:1 to UI bots
- Federal preemption unresolved
- Counts may change after September 2026
- Security
- Crisis and age-assurance features can increase sensitive-data processing—minimize retention.
- Proof of value
- Matrix of top 10 states vs product flags
- Carveout memo for FAQ mode
- Tabletop on emotional-dependence feature risk
Delivery
Role takeaway
- Work
- Stand up compliance register, counsel review cadence, and product change checklist tied to chatbot bills.
- Dependencies
- Legal
- Product
- Privacy
- State public-affairs for legislative watch
- Ownership
- Privacy/compliance lead with product co-ownership.
- Skills and adoption
- PMs need statute literacy; engineers need policy-pack deployment skills.
- Governance checkpoints
- Monthly bill delta review
- Pre-release carveout check
- Post-enactment 30-day remediation
- Acceptance criteria
- Published state matrix for in-scope bots
- Documented FAQ carveout rationale
- Crisis-protocol owner named where required
- Risks
- Misclassifying a bot as out-of-scope
- Feature creep into companion behavior
- Conflicting multi-state timing rules
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Vendors and state builders may need configurable disclosures, crisis-response hooks, minor/age pathways, and logging to meet divergent state models; agentic features raise additional action-authorization questions flagged in Part III.
Governance
Who approves, reviews and stays accountable for outcomes?
Highlights definitional models (capability vs behavior vs broad-with-carveouts) as the real scope control; AG enforcement dominates; private rights of action less common but present in some states.
Security and privacy
What data, permissions and controls need testing?
Emerging chatbot-specific limits on advertising, training use of chats, memory, and age-assurance data—especially for minors—on top of general privacy laws.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Report centers youth and vulnerable-user protections more than WCAG; notes educational/accessibility benefits of chatbots as a policy tension when drafting broad restrictions.
Procurement
What should contracts, pricing and exit terms secure?
State buyers should add chatbot-statute diligence (disclosures, crisis protocols, minor features, data/memory limits) into RFP questionnaires—especially for resident-facing assistants.
Operating model
Which teams own the service once it runs?
Implies ongoing legislative watch and product governance rather than one-time compliance; agentic expansion would require action-authorization controls beyond conversational UX rules.
Publication history
- 2026-09-23State Government · Issue 184 resources
Stable resource ID: fpf-us-chatbot-legislation-landscape-202609