If you ship a companion chatbot, an AI "friend," a character-roleplay app, or any conversational assistant that keeps people emotionally engaged, California's SB 243 is squarely aimed at you. The law focuses on companion chatbots and sets expectations around telling users they are talking to AI, protecting minors, and handling conversations that turn toward self-harm. For a solo developer about to submit to the App Store, the practical question is: are the user-facing signals a reviewer would look for actually present on your surfaces?
This checklist breaks SB 243 into concrete, shippable items. Where an item leaves a trace LaunchTrust can passively detect, we link the detector. Treat it as a planning aid, not a legal opinion on whether your product is in scope.
What SB 243 is actually about
SB 243 targets "companion chatbot" systems—AI designed to sustain ongoing, relationship-like or emotionally engaging conversation, not narrow task bots. The recurring themes are:
- Disclosure that the user is interacting with AI, so a reasonable person isn't misled into thinking they're talking to a human.
- Heightened care for minors, including reminders during use and limits on certain content.
- Protocols for self-harm and crisis content, such as surfacing crisis resources rather than ignoring the topic.
- Recordkeeping and transparency about how the system behaves.
Different obligations attach to different operators, and some duties phase in over time. Don't assume a single deadline applies to you—confirm scope and timing against the statute or with counsel. What you can do today is build the user-visible scaffolding.
The checklist
Each box below is something you can verify before you submit. Items marked [scannable] leave a public trace LaunchTrust can passively detect.
1. AI identity disclosure
- A clear, plain-language notice that the user is talking to AI, not a person, shown where the conversation happens—not only buried in your terms. [scannable] See the AI interaction disclosure detector.
- The notice appears for logged-out and first-time users, since that's what an anonymous visitor (and an automated check) sees first.
- You avoid implying the bot is human in marketing, persona names, or onboarding. A label like "AI-powered" alone does not substitute for an in-conversation disclosure.
2. Minor protections
- An age signal at entry—an age gate, date-of-birth prompt, or equivalent—so under-18 experiences can differ. [scannable] See the age-gate assurance detector.
- Recurring "you are talking to AI" reminders during longer sessions for younger users, where the law expects them.
- Content limits and guardrails appropriate for minors, documented in your policies.
3. Self-harm and crisis handling
- A defined protocol so that when a conversation indicates self-harm or suicidal ideation, the system surfaces crisis resources (such as a hotline) rather than continuing as if nothing happened.
- This behavior is tested before launch with realistic prompts, and logged for your records.
- Your published policies reference this safety behavior so users and reviewers can see it exists.
4. Policies and transparency
- A terms of service that names the AI nature of the product, acceptable use, and safety limits. [scannable] See the terms of service detector.
- A privacy policy covering conversation data, retention, and any model-training use—companion chats are sensitive. [scannable] See the privacy policy detector.
- Internal recordkeeping: evidence of your disclosures, crisis protocol, and minor safeguards.
5. Cross-jurisdiction overlap
- If you also have EU users, an interaction-transparency notice often does double duty—see the EU AI Act Article 50 checklist.
- Track other US state and federal expectations for AI and minors via the United States overview.
What LaunchTrust checks against this list
LaunchTrust does not certify SB 243 readiness or judge your crisis protocol. It passively fetches your public page and reports detected / not detected / unable to determine for the signals that do leave a trace—chiefly the AI interaction disclosure, an age gate, a terms of service, and a privacy policy. Internal duties like crisis routing and recordkeeping can't be seen from outside, so the scanner stays silent on them rather than guessing.
In short: a clean scan tells you the visible scaffolding is in place—not that the conversation logic, minor handling, or crisis response behind the screen meets the law.
A concrete example
A reviewer or a passive check reads AI disclosure best as plain text at the point of conversation:
You're chatting with an AI companion. Responses are AI-generated and may be inaccurate. If you're in crisis, contact a local helpline.
That one line touches three themes above—AI identity, an accuracy caveat, and a crisis pointer—and it's the disclosure-directed wording a scanner recognizes. A persona name like "Aria, your friend" with no AI notice nearby is the opposite: it reads as human and leaves the gap open.
How to address gaps
- Add an in-conversation AI disclosure on the chat screen for all users, including logged-out and first-run states.
- Put an age signal at entry so you can branch behavior for minors and show the reminders the law expects.
- Implement a crisis protocol that detects self-harm cues and surfaces real resources, then test it with realistic prompts and log outcomes.
- Publish a terms of service and privacy policy that name the AI nature of the product and explain conversation-data handling.
- Keep internal records of your disclosures, safeguards, and crisis behavior so you can demonstrate them if asked.
- Re-scan your public URL to confirm the visible signals flipped to detected.
Check this in 30 seconds
Run your companion app's URL through LaunchTrust's free scanner. It fetches your live page and reports whether an AI interaction disclosure, age gate, terms, and privacy policy are detected, not detected, or unable to determine—so you close the visible gaps before you submit.
FAQ
Does passing the LaunchTrust scan mean my companion app meets SB 243? No. The scan surfaces a handful of externally visible signals—an AI disclosure, an age gate, your terms and privacy policy. SB 243 also covers behavior the scanner can't see, like crisis routing and recordkeeping. A clean scan is a starting point, not legal advice or certification.
Is my chatbot a "companion chatbot" under SB 243? That's a scope judgment, not a scan result. The law targets AI built for ongoing, emotionally engaging or relationship-like conversation. Narrow task bots may fall outside it; confirm borderline cases against the statute or with counsel.
Where exactly should the AI disclosure appear? Where the conversation happens—the chat screen or assistant panel—so a user knows in the moment they're talking to AI. A disclosure that lives only inside your terms is easy to miss and won't be detected on the chat surface.
Are there hard deadlines I need to hit? SB 243 includes operative dates, and some duties phase in. Rather than rely on a date repeated here, confirm current timing in the statute or with a professional, and build the disclosures and safeguards now.
Compliance aid, not legal advice. LaunchTrust reports signals, not a verdict or certification.