Colorado's AI Chatbot Law: What HB 1263 Changes and When

Two dates, not one

The confusion here is structural rather than anyone's fault. Colorado bills that carry no safety clause take effect ninety days after the legislature adjourns — the window in which a referendum petition could be filed under article V, section 1(3) of the state constitution. For the 2026 session that landed on 12 August 2026, and it is the date legislative trackers list in their "effective" column.

The bill then sets its own commencement for the substantive duties: 1 January 2027. Annual reporting to the attorney general runs later again. So a headline saying Colorado's chatbot law is now in force is technically accurate and practically misleading. If you opened a companion app in Denver this week, nothing about it was required to be different.

What the law actually requires

HB 26-1263 regulates a conversational artificial intelligence service: a publicly available system that primarily simulates human conversation through adaptive text, visual or audio communication. Companion apps and character-chat platforms sit squarely inside that definition — conversation is the product, not a support feature bolted onto one.

An operator is the party that develops and makes such a service publicly available. That distinction does real work. A business that embeds a third-party chat widget is generally a customer of an operator rather than an operator itself, and liability is framed to land on the party running the chatbot rather than on the upstream model developer.

The duties themselves fall into five groups:

• Age estimation. Operators must estimate the age of account holders and users using commercially reasonable or generally accepted methods. Note the verb: estimate, not verify.
• Disclosure. Every user must be notified that the service is artificial intelligence and not a human being.
• Minor-specific limits. Where an operator knows a user is a minor, it must provide specific disclosures, drop points or rewards designed to increase engagement, and take technically feasible measures to prevent sexually explicit content, intimate digital depictions and simulated emotional dependence. It must also stop responding to prompts about sexual conduct with minors, and provide privacy and account-management tools to the minor or a guardian.
• Crisis protocol. A documented protocol for responding to expressions of suicidal ideation or self-harm, reported annually to the attorney general.
• No professional impersonation. Output cannot be represented as provided by, endorsed by, or equivalent to services from a licensed or certified professional.

Enforcement runs through the Colorado attorney general, with a violation treated as a deceptive trade practice under the Colorado Consumer Protection Act. Published summaries disagree on the per-violation civil penalty, so we are not quoting a figure here; the enforcement route is the part that is consistently reported.

The one clause worth arguing about

"Simulated emotional dependence" is the most consequential phrase in the bill, and the least defined. Every companion app that works at all produces some emotional response — that is the category, not a defect in it. The statute does not draw a line between a persona that remembers your birthday and one engineered to make leaving feel costly, and the difference between those two is a design intent that is hard to read from the outside.

In practice the enforceable core is likely to be the adjacent clause banning points and rewards that increase engagement for minors, because streaks, daily-login bonuses and unlockable affection meters are observable in a way that emotional design is not. We have written before about how retention mechanics are where companion apps quietly diverge from healthy use; Colorado is the first US statute we are aware of that names that mechanism directly rather than treating it as a content question.

Where Colorado sits in the 2026 wave

It is not an outlier. A tracker maintained by the Transparency Coalition recorded fourteen chatbot safety measures across thirteen states enacted during 2026, and the effective dates are clustered ahead of us rather than behind.

Read down the effective column and the pattern is obvious: the 2026 legislative year produced the statutes, and 2027 is when they bite. Colorado's early effective date is a drafting artefact, not evidence that it moved faster on substance.

What you will actually notice, and when

An age question that arrives earlier

Age estimation is a weaker standard than documentary verification, and that distinction is worth holding onto — Colorado does not demand a passport scan. But operators serving several states at once tend to build to the strictest requirement they face, so the practical outcome may be stronger checks than this statute alone would produce. Sign-up flows are already where companion apps lose the most users, a problem we covered in onboarding friction.

Engagement mechanics thinning out on teen accounts

Streaks and reward loops are cheap to remove and easy to audit, which makes them the first thing to go once an account is classified as a minor. Expect the gap between adult and teen experiences to widen rather than narrow through 2027.

Crisis handling becoming a compliance surface

Once a documented protocol is reportable to a state attorney general, the quality of that protocol stops being purely a product choice. The failure mode to watch is over-triggering — a referral that fires on the word "die" inside a fantasy battle scene is a worse experience than one that reads context, and it is exactly the kind of thing that ships when a deadline is close.

What this does not settle

Colorado leaves open the same question the Congressional Research Service brief identified as the central unresolved one: how much identity an app must collect before it can decide what to show you. Age estimation is a deliberate hedge between that and doing nothing, and whether it holds up depends entirely on how the attorney general's office reads "commercially reasonable" once the duties commence.

For anyone outside the US, the operative frameworks remain the EU AI Act's transparency article and China's interim measures, both already in force — a reminder that the US state patchwork is the slower of the three tracks, not the leading one. If you would rather act on your own account than wait for 2027, our privacy checklist covers the settings available to you today.

Frequently asked questions