Gavin Newsom signed two bills this week that his office is calling the strongest child-safety chatbot and social media laws in the country. Big claim. The kind of claim that gets a press release and a signing ceremony with a room full of parents behind the governor.
Here’s the part nobody at that ceremony wanted to say out loud. California doesn’t actually know how to do age verification. It never has. The state has spent two decades building age gates for alcohol, tobacco, firearms, and gambling, and every single one of those systems still leaks. Now Sacramento wants tech companies to solve, in software, a problem the state itself hasn’t solved with driver’s licenses and ID scanners.
That’s not a reason to oppose the new law. Kids interacting with unregulated chatbots is a real problem, and Pew Research found nearly a third of American teens talk to an AI chatbot every single day. But it is a reason to be honest about what “age verification” actually means when a state government demands it. And once you start asking that question, the chatbot fight stops looking new. It looks like the same fight California has been losing for years, just with a shinier villain.
The Digital Age Assurance Act didn’t come out of nowhere
The new chatbot and social media rules sit on top of an existing law that most people outside the tech policy world barely noticed. AB 1043, California’s Digital Age Assurance Act, already requires operating systems (not just apps, the actual OS layer on your phone or laptop) to support age signals that developers can use to restrict content. Tom’s Hardware covered just how far that reach extends, noting the law applies even to niche systems like SteamOS and Linux distributions, which is a strange place to end up for a bill originally sold as a parental-controls measure.
That’s the law Newsom’s new chatbot rules are grafted onto. And it matters because AB 1043 exposed the core problem months before this week’s signing: nobody has agreed on what counts as reliable proof of age online. Some platforms want device-level signals. Some want ID uploads. Some want facial estimation software that guesses your age from a selfie, which is about as reliable as it sounds.
Meanwhile, California has a decades-old model sitting right in front of it for how age-gated adult products are supposed to work when the state actually enforces the rules properly. Legal, regulated online gambling. Not the offshore, unlicensed apps that dodge every check. The real, compliant operators that Californians can legally use for social and sweepstakes-style casino play, since traditional real-money online casino gambling and sports betting remain illegal in the state as of this month. Sites that follow this model run identity verification, geolocation, and payment-source checks before a single dollar moves, and they document every step because a state gaming regulator will eventually ask for the paper trail. Esports.gg’s California casino guide lays out exactly what that compliant tier looks like, and it’s a useful contrast precisely because it shows verification done with teeth, not a checkbox nobody audits.
Gambling involves real financial risk for adults, and this piece isn’t a recommendation to gamble. It’s a comparison point: one corner of California’s regulated internet has real enforcement behind its age and identity checks, and the corner lawmakers just spent a week celebrating mostly doesn’t yet.
Why the comparison is uncomfortable for Sacramento
Here’s the thing. Casino-style platforms that take this seriously don’t rely on a single self-reported birthdate typed into a form. They layer it. ID verification tied to payment processors. Session monitoring. Geofencing that actually blocks access from outside approved boundaries, not the honor-system geofencing that a VPN defeats in ten seconds.
Compare that to what AB 1043 asks operating systems to do. A device-level age signal that any teenager with a older sibling’s login, a fake birthdate, or five minutes on a forum can route around. The bill doesn’t mandate ID verification. It mandates a checkbox architecture and calls it protection.
So why does one regulated industry get a real system while another gets a signal?
Money, mostly. Gambling operators that fail age and identity checks lose their licenses and get fined into the ground. A social media platform that fails a soft age gate gets a strongly worded press statement and maybe a lawsuit that settles years later. Meta just agreed to pay up to $18 billion to California and other states over claims it knowingly built products designed to be addictive to minors, and that settlement only happened after years of litigation, not because a state regulator caught the problem in real time the way a gaming commission would.
That’s the actual gap. Not technology. Enforcement appetite.
The teen chatbot numbers are not small
It’s worth sitting with how big the underlying behavior actually is before dismissing this as another moral panic bill. CNN reported on the Pew data showing daily teen chatbot use has become mainstream, not a fringe habit confined to a handful of tech-forward households. That’s a lot of unsupervised, unverified conversation happening between minors and systems with no real proof of who’s on the other end of the keyboard.
Contrast that scale against how California treats a 21-year-old trying to open a legal gaming account. Documents. Verification steps. A compliance team somewhere reviewing flagged accounts. Nobody’s asking chatbot providers to build anything remotely that rigorous. They’re asking for a settings toggle.
Maybe that’s fine as a first step. Laws often start soft and tighten later. But Sacramento shouldn’t get to call this the “strongest” child-safety law in the nation while leaving the actual verification mechanism roughly where alcohol delivery apps were a decade ago, before most of them adopted ID-scan-at-the-door protocols.
What actually changes now, and what doesn’t
The chatbot provisions require companies to build in break reminders, restrict certain content for accounts flagged as minors, and face liability if a chatbot encourages self-harm. Those are real, meaningful changes and worth crediting. The social media piece leans on the age-signal infrastructure from AB 1043 rather than inventing something new.
What doesn’t change: the actual verification layer underneath all of it. Nobody in Sacramento has committed to ID-based verification for chatbot access the way, say, a state-licensed sportsbook in New Jersey verifies identity before a first deposit clears. The political appetite isn’t there. Tech companies lobbied hard against anything that looks like a real ID check, citing privacy concerns that are, to be fair, not entirely manufactured.
So the state ends up with a law that sounds tough in a press release and functions, underneath, on the same soft-signal architecture that’s failed everywhere else it’s been tried. Gambling operators cracked this problem because regulators forced them to and punished failure hard. Chatbots haven’t been forced yet.
Frequently asked questions
What does California’s new chatbot law actually require? The law requires AI chatbot providers to build break reminders for minors, restrict certain content for accounts flagged as underage, and accept liability if a chatbot response encourages self-harm. It builds on the existing Digital Age Assurance Act’s age-signal framework rather than creating a new verification standard.
Is age verification the same across California’s chatbot, social media, and gambling laws? No. Gambling platforms that follow real compliance standards use layered identity and payment verification with regulatory audits behind them. Chatbot and social media rules currently rely on device-level age signals, which are far easier to bypass and carry no equivalent enforcement mechanism.
Why did Meta agree to pay California and other states so much money? Meta settled claims that it knowingly designed features to be addictive to minors, agreeing to pay up to $18 billion across California and other participating states. The settlement followed years of litigation rather than real-time regulatory enforcement.
How many teens actually use AI chatbots regularly? Pew Research found that nearly a third of American teens interact with an AI chatbot on a daily basis, a scale that has pushed lawmakers to treat chatbot regulation with the same urgency previously reserved for social media.
Does California’s Digital Age Assurance Act require ID verification? No. AB 1043 requires operating systems to support age signals that developers can use, but it stops short of mandating ID-based verification, which is the gap critics point to when comparing it against more rigorously enforced regulated industries.
The real fight is about enforcement, not software
California will keep passing laws that sound decisive and function on soft signals until someone in Sacramento decides the verification gap actually matters enough to fund real enforcement. That’s not a technology problem. Building rigorous identity checks isn’t hard; regulated gambling proved that years ago. It’s a political problem, and political problems get solved when the cost of inaction outweighs the lobbying against action.
For now, parents get a headline about the strongest child-safety law in the nation. What they don’t get is a system that verifies age any better than the one that failed with social media a decade ago. That gap is worth watching closely as more states draft their own versions of this law over the next year.
