Where AI companions are actually illegal right now
Italy fined Replika €5 million. China is drafting mandatory two-hour break warnings. New York requires suicide detection. Maine wants to ban AI therapy bots outright. Here's the jurisdictional map of what's actually legal, restricted, and banned as of mid-2026.
May 19, 2026 · 10 min read
The legal status of AI companion platforms is moving faster than any other corner of AI policy right now. Italy levied a €5 million fine on Luka, Replika's developer, in May 2025. New York's S-3008C is already enforcing suicide detection protocols. Washington passed disclosure mandates in April 2026. China's Cyberspace Administration released draft rules in December 2025 that would require AI companions to interrupt users every two hours. Maine is on the governor's desk with a bill that would ban AI therapy bots outright.
Most users have no idea any of this is happening because the platforms implement the changes quietly. Most listicle writers don't track jurisdictional differences because it's tedious. Here's the actual map.
Status by jurisdiction, mid-2026
The table below covers fifteen jurisdictions where there's been concrete enforcement action, passed legislation, or imminent regulation. "Legal" means no specific restrictions; "Restricted" means active regulatory requirements that limit platform behavior; "Banned" means specific platforms or categories have been blocked or are slated for blocking; "Pending" means draft legislation is in active consideration.
| Jurisdiction | Status | What's actually happening |
|---|---|---|
| Italy | Restricted | Garante issued €5M fine to Luka (Replika) in May 2025 for GDPR violations: no age verification, unclear data processing basis, processing of minor data without parental consent |
| European Union | Pending | AI Act fully enforceable August 2026; high-risk AI systems face fines up to €35M or 7% global revenue; companion platforms not auto-classified high-risk but specific behaviors may trigger Article 5 prohibitions |
| China (mainland) | Restricted | Interim Measures for Generative AI (Aug 2023) require service registration; draft Anthropomorphic Interaction rules (Dec 2025) require pop-up AI disclosure and 2-hour use breaks; AI-generated content labeling mandatory since Sep 2025 |
| United Kingdom | Restricted | Online Safety Act enforcement began July 2025; NSFW-capable AI companion platforms must implement age verification (ID upload, facial age estimation via Yoti/AgeChecked); fines up to 10% global annual turnover |
| New York (US) | Restricted | S-3008C took effect Nov 5, 2025; requires AI companions to detect suicidal behavior and connect to crisis resources, plus mandatory AI disclosure on every session |
| Washington (US) | Restricted | AI chatbot disclosure law passed April 2026; requires upfront AI identification and crisis service routing for distress signals |
| California (US) | Pending | SB 867 (AI chatbot and toy ban for minors) in active consideration; multiple AI companion liability bills in committee |
| Maine (US) | Pending | AI therapy bot ban on governor's desk as of April 2026; would prohibit platforms positioning as mental health support without licensed professional oversight |
| Tennessee (US) | Pending | Multiple AI companion bills introduced in 2026 session; specifics still in committee revision |
| Utah (US) | Pending | AI companion disclosure and minor protection bills active in legislative session |
| Florida (US) | Restricted | HB 3 age verification requirements affect NSFW-capable platforms; enforcement upheld November 2025 |
| South Korea | Restricted | AI Basic Act took effect 2025; requires transparency about AI interaction and data handling for emotional-support AI services |
| Japan | Legal | AI legislation framework under development but no specific AI companion restrictions; payment processor pressure has affected some adult-adjacent platforms independently |
| Australia | Restricted | Online Safety Act age verification expansion includes AI companion platforms with NSFW capability; enforcement began 2025 |
| Most other countries | Legal | No specific AI companion legislation; platforms operate under general consumer protection, data privacy, and obscenity laws |
The patterns across these jurisdictions
A few patterns emerge when you look at the map together rather than country by country.
The privacy hook does most of the work in Europe. Italy's action against Replika wasn't an AI-specific regulation. It was the GDPR applied to a platform that processed minor data without consent and couldn't articulate a lawful basis for its data processing. The €5 million fine and the original 2023 service block both happened through Article 58(2)(f) of the GDPR, the same mechanism used to fine OpenAI €15 million the previous year. The EU AI Act adds another layer arriving in August 2026, but the operational regulation right now is GDPR.
The crisis hook is doing the work in US states. New York's S-3008C, Washington's April 2026 law, Maine's pending therapy bot ban, and most of the state-level bills converge on one specific concern: AI companions that fail to detect or respond to mental health crises. The legislative response traces directly to the Setzer III case and similar incidents. The pattern in Roborhythms' analysis of the 2026 wave is consistent: disclose that you're an AI, detect distress, connect to crisis resources, or face penalties.
The state hook is doing the work in China. The Cyberspace Administration's draft Anthropomorphic Interaction rules require AI companions to take pop-up breaks every two hours, avoid emotional manipulation, and prevent "AI companion addiction." The framing is concrete: the state has decided AI companions can be psychologically harmful to users, and platforms operating in mainland China will be required to actively work against that harm. The rules also bar AI companions from generating content that could subvert state power, which is the broader umbrella under which all Chinese AI regulation operates.
Age verification is the bipartisan common ground globally. The UK, Florida, Australia, and most of the pending US state legislation share one specific requirement: meaningful age verification, typically meaning ID upload or biometric facial age estimation through providers like Yoti. The credit-card-as-age-proxy approach is being deprecated globally as inadequate. Platforms that operate in multiple jurisdictions are converging on Yoti-style biometric estimation because it scales across regulatory regimes.
What this means for users practically
If you're in the US outside of New York or Washington, you're effectively in a legal gray zone where the platforms are operating but the regulatory infrastructure is being built. Your data protections depend entirely on the platform's voluntary policies. The platforms responding fastest to the emerging regulatory pressure are the ones with EU and UK customer bases, since they're already implementing the strictest requirements there and rolling them out globally as the default.
If you're in the EU or UK, the platforms you can use are already being filtered by which ones can comply with GDPR and the Online Safety Act. Several smaller AI companion platforms have stopped serving the EU entirely rather than implement the compliance overhead. The ones that remain are typically the larger, better-funded operations.
If you're in mainland China, the situation is more constrained. Domestic platforms like Xingye and Maoxiang Character operate under Chinese AI regulations. Foreign platforms are generally inaccessible without VPN, and VPN use itself is in a gray legal zone.
The legal framework around AI companions in 2026 is being built rapidly and unevenly, with most platforms scrambling to comply with the strictest applicable regime rather than running parallel compliance per jurisdiction. The user-facing effects of this regulatory wave will mostly take the form of features quietly appearing or disappearing rather than dramatic platform shutdowns. New York's disclosure requirement is already in effect on every major platform, and most users haven't noticed.