Oregon and Washington Chatbot Disclosure Laws: Compliance Guide for Multi-State Businesses

If your business deploys a chatbot — a customer service bot, a virtual assistant, a companion-style AI tool — you need to know about three state laws that are reshaping what disclosure means in the United States. California moved first. Oregon and Washington followed. All three laws target interactive AI systems that engage users in natural, human-like conversation. All three are now on the books. And all three create real legal exposure if you ignore them.

This post breaks down what Oregon and Washington require, how their laws compare to California’s, and what multi-state businesses need to do right now to get ahead of a January 1, 2027 compliance deadline.

The West Coast Chatbot Regulatory Wave

California enacted SB 243 in 2025, making it effective January 1, 2026. That law established the country’s first mandatory AI chatbot disclosure requirements for consumer-facing interactive AI. The core idea was straightforward: users have a right to know when they’re talking to a machine, especially when the machine is designed to feel like a person.

Oregon and Washington didn’t wait to see how California’s law played out. Both states passed their own companion chatbot legislation in 2026 — Oregon’s SB 1546 and Washington’s HB 2225 — and both laws take effect on January 1, 2027. The Future of Privacy Forum has published a comparison chart setting the three laws side by side, and the picture that emerges is a West Coast regulatory bloc that, taken together, covers a massive portion of US economic activity.

If you have customers in any of these three states — and if your chatbot is designed to sustain conversation, build user relationships, or provide emotional support — you are likely covered.

Who Is Covered: The Definition of “Operator”

Both Oregon SB 1546 and Washington HB 2225 define “operators” broadly. You are an operator if you make available or control access to an AI companion or companion chatbot platform for users in the respective state. This is not limited to companies headquartered in Oregon or Washington. If your chatbot reaches users in those states, you are subject to the law.

The laws also include subcontractor and platform liability considerations. If you operate a platform on which third parties deploy chatbots to your users, you may have obligations as well.

What Type of Chatbot Is Covered?

The laws do not cover every AI system. They are targeted at “companion” or “consumer-facing interactive AI” — chatbots that:

• Use a natural language interface
• Provide adaptive, human-like responses
• Are designed to sustain relationships across multiple interactions

There are carve-outs. Washington specifically excludes narrowly tailored educational tools, general virtual assistants, consumer electronics interfaces, and certain business-oriented and gaming bots. Oregon’s scope is somewhat narrower by design, using a behavior-based definition with more carve-outs than California’s or Washington’s capability-based approaches.

The practical implication: a chatbot that handles customer support tickets and does not simulate ongoing emotional relationships is likely outside the scope of these laws. A chatbot designed to be a friend, therapist, companion, or romantic partner is clearly inside the scope. The gray zone covers chatbots that build user rapport over time, remember previous conversations, and adapt their tone to individual users — common features in modern AI customer engagement tools.

Core Disclosure Requirements: What You Must Tell Users

The Basic Disclosure Obligation

All three state laws — California, Oregon, and Washington — require operators to clearly and conspicuously disclose that users are interacting with an AI system whenever a reasonable person might believe they are speaking with a human. The disclosure must appear at the start of the interaction.

This is not an optional feature or a buried terms-of-service acknowledgment. The disclosure must be clear, must appear upfront, and must be genuinely noticeable to an ordinary user.

Recurring Disclosure Obligations

Here is where the three laws diverge in an operationally important way:

For adult users:
– California and Oregon use a “reasonable person” standard. If a reasonable person would understand they’re talking to AI, no recurring reminder is needed.
– Washington requires a reminder disclosure every three hours for all users, regardless of whether confusion seems likely.

For minor users (under 18):
– California and Oregon require a disclosure reminder every three hours.
– Washington requires a disclosure reminder every hour.

For businesses with session-based or long-duration chat interfaces — think customer support, mental wellness apps, or any platform where users might engage for extended periods — this means engineering recurring disclosure messages directly into the chat flow. Logging those disclosures for audit purposes is a practical necessity.

Protections for Minors

All three laws treat minor users as a special category requiring heightened protections. If your platform knows or reasonably should know that a user is under 18, additional rules apply.

Operators must implement measures to prevent their chatbots from:
– Making false claims of being human or sentient
– Simulating romantic relationships or sexual innuendo with minors
– Using manipulative engagement techniques designed to exploit minor users
– Creating artificial emotional dependence

Washington’s law is the most prescriptive here, spelling out specific prohibited behaviors in detail. Oregon’s law is close behind. California’s original framework is somewhat less detailed but follows the same protective rationale.

If your chatbot serves any audience that may include minors — including general consumer platforms — you need age-verification or age-detection mechanisms, and your chatbot’s behavioral guardrails must be engineered to these standards for detected or identified minor users.

Crisis Protocol Requirements: Mental Health and Self-Harm

This is the provision that most businesses have not thought about, and it is the one that carries the greatest operational complexity.

All three state laws require operators to adopt crisis detection and response protocols — meaning your chatbot must be capable of detecting when a user expresses suicidal ideation or intent to self-harm, and must respond appropriately.

Specifically, the laws require:
– Detection of expressions of suicidal ideation or self-harm in user messages
– Interruption of the conversation when such content is detected
– Referral to crisis resources such as the national 988 Suicide & Crisis Lifeline or youth peer support services
– Annual public reporting of crisis intervention protocols and statistics

On the annual reporting requirement: Washington and Oregon require these reports to be publicly accessible, at minimum on the operator’s website. California has a similar annual reporting obligation. These disclosures must include the number of times during the preceding year the operator provided crisis referrals, the operator’s intervention protocols, and how clinical best practices inform ongoing engagement with at-risk users.

Oregon’s SB 1546 specifically requires that the intervention protocols reflect clinical or evidence-based standards. Washington’s HB 2225 does not have the same explicit clinical standards requirement, but still mandates that protocols be developed and disclosed.

The compliance burden here is significant. If your chatbot engages users in any kind of emotional or personal conversation, you need:
1. A natural language processing pipeline capable of detecting distress signals
2. A defined escalation flow with appropriate crisis referrals
3. Documentation of your protocols
4. A mechanism for logging and counting referrals on an annual basis
5. A public-facing disclosure of your protocols

Enforcement and Liability: This Is Not a Paper Tiger

Oregon SB 1546

Oregon’s law provides a private right of action. Users who are harmed by violations may sue directly, without needing to wait for regulatory action. The statutory damages provision is significant: $1,000 per violation, or actual damages if higher, plus injunctive relief and attorneys’ fees.

The phrase “per violation” matters enormously. If your chatbot fails to make required disclosures in thousands of user interactions, each interaction is potentially a separate violation. Class action exposure is real and direct.

Washington HB 2225

Washington’s law is enforced primarily by the Washington Attorney General under the state’s Consumer Protection Act. The CPA is a well-developed enforcement vehicle that Washington’s AG has used aggressively in consumer-facing contexts. Washington’s law also includes a private right of action in certain contexts.

California SB 243

California mirrors Oregon’s enforcement structure: private right of action, $1,000 statutory damages per violation, injunctive relief, and attorneys’ fees.

Taken together, three states now offer mechanisms for class action litigation against chatbot operators who fail to comply. This is no longer a speculative regulatory risk. It is an active litigation environment.

Multi-State Compliance: The Practical Challenge

If you operate a chatbot used by customers in California, Oregon, and Washington, you face three overlapping regulatory regimes with materially different requirements. Here is how to think about the compliance matrix:

Unified Disclosure Architecture

The most practical approach is to design your disclosure framework to satisfy the most stringent requirements across all three states. In practice, that means:

• Upfront AI disclosure at the start of every interaction (required by all three)
• Recurring disclosures every hour for users who are minors (Washington’s standard, which is stricter than Oregon and California)
• Recurring disclosures every three hours for adult users (Washington’s standard, stricter than Oregon and California for adults)

Designing to Washington’s standard satisfies the requirements in all three states.

Age Detection

All three states impose heightened obligations for minor users. If you cannot verify user age, consider applying the minor-protective standards to all users as a conservative compliance position. The marginal cost of treating all users as potentially minor is far lower than the litigation cost of a violation.

Crisis Protocols

Build crisis detection and response protocols that meet Oregon’s clinical standards requirement. Oregon’s standard is the most demanding. A protocol that satisfies Oregon will satisfy Washington and California.

Annual Reporting Calendar

Mark your calendar: annual public reporting on crisis protocols is required. Set internal deadlines for data collection and report publication that give you time to compile the required statistics on referral volume and intervention protocols. These reports must be publicly accessible — plan for a dedicated section on your website.

Documentation and Logging

Log all user disclosures. Log all crisis protocol activations and referrals. Maintain records of when and how disclosures were delivered. In class action litigation, your ability to demonstrate actual compliance with disclosure timing requirements will depend on what you logged.

What Businesses Are Excluded?

Not all AI tools are covered by these laws. The following categories are generally excluded:

• Narrowly tailored educational tools — AI tutoring systems with clearly bounded educational functions
• General virtual assistants — Tools like Siri, Alexa, or Google Assistant used for commands and queries
• Consumer electronics interfaces — AI built into device hardware controls
• Business-oriented chatbots — Tools designed for employee workflow, IT support, or other clearly professional contexts
• Gaming AI — In-game characters and interactive story AI with clear fictional context

If your chatbot falls cleanly into one of these categories, you may be outside the scope of the laws. But be careful: a “customer service chatbot” that is also designed to build rapport, personalize emotional tone, and sustain long-term user relationships may cross the line into companion chatbot territory regardless of how you describe it internally.

Immediate Action Items for Multi-State Businesses

If you operate a consumer-facing chatbot and have users in California, Oregon, or Washington, here is what you should be doing now — before the January 1, 2027 effective date for Oregon and Washington:

1. Conduct a chatbot audit. Identify every AI-powered conversational tool that reaches users in these states. Map their features against the companion chatbot definitions in each law.

2. Review your disclosure architecture. Is your upfront AI disclosure clear, conspicuous, and unavoidable? Is it logged? Is there a mechanism for delivering recurring disclosures at the required intervals?

3. Build or audit crisis detection capabilities. Does your chatbot have the ability to detect distress signals? Is there a defined escalation flow? Are referrals to crisis resources built into the response protocol?

4. Update your BAA and vendor contracts. If you use a third-party chatbot platform, your vendor contract should address who bears responsibility for compliance with these disclosure laws. Do not assume your vendor has handled this.

5. Establish an annual reporting workflow. Create the internal infrastructure to compile annual crisis protocol data and publish the required public disclosures.

6. Consult legal counsel on your specific product. The line between a covered companion chatbot and an excluded business tool is not always clean. An analysis of your specific product features against the statutory definitions is worth doing before a plaintiff’s lawyer does it for you.

The Broader Context: What Comes Next

These three states are not operating in isolation. As of mid-2026, more than 78 state bills touching AI chatbot regulation have been introduced across the country. The regulatory trend is clearly toward more disclosure requirements, more minors protections, and more crisis protocol mandates — not fewer.

The federal government has not yet acted with binding AI chatbot legislation, but that does not mean the regulatory landscape is stable. The FTC has signaled interest in deceptive AI practices. OCR has issued guidance on AI in healthcare contexts. State attorneys general in non-West-Coast states are watching how California, Oregon, and Washington enforce their laws.

Businesses that build compliance infrastructure now — documentation systems, logging architecture, crisis protocol workflows, and annual reporting calendars — will be better positioned when the next wave of state legislation hits. Those that treat these laws as an Oregon and Washington problem will be building compliance frameworks from scratch each time a new state joins the bloc.

Conclusion

Oregon SB 1546 and Washington HB 2225 are not duplicates of California’s law. They build on it, in some respects go beyond it, and together with California create a multi-state compliance obligation for any business operating consumer-facing interactive AI in the western United States.

The disclosure requirements are technically manageable if you plan for them now. The crisis protocol requirements are operationally complex but achievable. The enforcement mechanisms — including private rights of action and statutory damages — make non-compliance genuinely expensive.

The January 1, 2027 effective date for Oregon and Washington is closer than it appears. If your chatbot serves users in these states, start your compliance review today.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.