California AI Toy Ban Turns Chatbot Behavior Into a Product Safety Issue

California has enacted a four-year AI toy restriction that treats conversational software as a potential product hazard, even when the physical toy works correctly.

The California AI toy ban arrives through Senate Bill 867, which Governor Gavin Newsom signed on September 10, 2026. Starting January 1, 2027, covered companion chatbots cannot be built into toys designed for children under 16.

That approach creates a direct conflict between adaptive AI features and traditional product safety practices. Filters, warnings, and parental controls do not create a compliance route under the law. A covered product must lose the companion functionality or leave California’s toy market.

The measure also changes who must care about chatbot behavior. Model providers remain important, but manufacturers, distributors, and retailers now face consequences tied to the finished product.

California is effectively asking companies to treat prompts, memory, persona settings, and model updates like design decisions. That is a substantial change from treating the same components as separate software services.

SB 867 Blocks the Feature, Not Just Unsafe Responses

SB 867 does not merely regulate what an AI toy can say. It prohibits a defined category of chatbot functionality inside covered toys.

The SB 867 text prohibits manufacturing, selling, exchanging, or offering a toy that includes a companion chatbot. It also covers possessing such a toy with the intent to sell or exchange it.

The law defines a toy as a physical product designed, marketed, or manufactured for play by children under 16. The restriction remains in effect until January 1, 2031.

That sunset makes the measure a moratorium rather than a permanent ban. Still, four product cycles can represent a long interruption for toy companies, especially those developing connected products.

The definition of a companion chatbot comes from California’s existing chatbot framework. It covers an AI system that provides adaptive, human-like responses through a natural-language interface.

The system must also be capable of meeting social needs. Relevant characteristics include anthropomorphic behavior and the ability to sustain a relationship across multiple interactions.

That language draws the line around relational behavior, not every use of artificial intelligence. A toy that recognizes speech or answers fixed questions does not automatically qualify.

The statute also excludes several categories. Customer service tools, business systems, research applications, and technical assistants fall outside the companion chatbot definition.

A video game character can also remain outside the definition when its replies stay within the game. The exclusion disappears when a character can discuss self-harm, mental health, sexually explicit conduct, or unrelated subjects.

Standalone voice assistants receive another exclusion. However, they must not sustain relationships across multiple interactions or produce responses likely to prompt emotional reactions.

These distinctions will matter during product classification. A talking device may appear harmless until memory, personalization, or an affectionate persona turns isolated replies into an ongoing relationship.

The law contains no certification process that permits a covered toy after testing. It also provides no exception based on a company’s confidence in its moderation system.

A manufacturer cannot simply add a warning that the character is artificial. Session timers, parental dashboards, and content filters do not remove a product from the prohibition.

The decisive question is whether the finished toy contains the covered functionality. As a legal analysis observed, avoiding the restriction requires changing the product so it falls outside the statutory definition.

That design-focused test separates SB 867 from many online safety rules. Most platform laws permit a service to operate when it adopts specified disclosures, audits, or protective controls.

California chose a harder boundary for toys. The state is not asking whether a companion feature has enough safeguards. It is temporarily keeping the feature out of the covered product category.

This distinction creates the article’s central tension. AI developers tend to treat model behavior as adjustable after launch, while product safety systems expect risks to be resolved before sale.

A chatbot can change after a model replacement, prompt revision, or cloud update. The stuffed animal or robot surrounding it may remain physically identical.

Under the California AI toy ban, that software change can alter the legal character of the entire product. The important component is no longer only what sits inside the casing.

The California AI Toy Ban Expands the Safety Perimeter

The practical change is larger than a temporary sales restriction because software behavior now enters the product’s safety record.

Traditional toy compliance focuses on properties that can be tested before distribution. Manufacturers examine materials, small parts, batteries, electrical systems, labeling, and foreseeable physical misuse.

Conversational AI behaves differently. Its output depends on the model, system instructions, conversation history, user phrasing, safety filters, and later service updates.

Two physically identical toys can therefore behave differently. They might use different model versions, account settings, regional policies, or cloud configurations.

The relevant design record must expand accordingly. Companies need to know which model runs the conversation, who controls its instructions, and whether it retains information between sessions.

Memory settings deserve particular attention. Memory helps a character recall a child’s name, interests, fears, and previous conversations. Those details can make an interaction feel continuous and personal.

That continuity also helps determine whether the system sustains a relationship. A feature promoted as better personalization can therefore push a product closer to the statutory definition.

Persona design raises the same problem. A character that expresses affection, disappointment, or dependency can create stronger engagement than a neutral question-answering tool.

That behavior does not require a defective physical component. It can emerge from prompts, fine-tuning, reward systems, or instructions created by a vendor outside the toy company.

The California AI toy ban places pressure across that fragmented supply chain. A brand may design the character while another business supplies the model.

An integrator may connect the model to microphones and speakers. A hosting provider may deploy updates, while a retailer sells inventory created under an earlier configuration.

This division of control creates a basic accountability problem. The company holding the product certification may not control the system that generates each response.

Manufacturers now need a reliable map of those responsibilities. They must identify who can change prompts, replace models, adjust memory, review incidents, or disable the service.

That map should also cover contractual authority. A toy company needs more than a vendor’s general promise to follow applicable law.

It needs notice before material software changes. It also needs records describing model versions, safety configurations, testing results, and the people authorized to approve deployment.

Maintaining those records resembles building a searchable AI knowledge base for product decisions. The purpose is traceability, not merely document storage.

Retailers face a different form of pressure. They rarely select a model or write system instructions, yet SB 867 expressly reaches selling and offering covered toys.

A retailer must know what functionality is inside a product before placing it on a shelf. Packaging language alone may not reveal whether a character maintains a relationship across sessions.

Product updates can also create stranded inventory. A compliant interactive toy might receive a companion feature after units have entered warehouses or stores.

The reverse situation is possible too. A manufacturer might disable relational features remotely, but retailers would need dependable evidence that every affected unit received the change.

Privacy teams cannot remain separate from this process. Voice recordings, account profiles, and dialogue histories can support the memory that makes a chatbot relational.

The same data can reveal sensitive information about a child. It can also influence later responses, making data governance part of the product’s behavioral safety.

For businesses, the new safety perimeter reaches model governance, privacy review, inventory controls, and supplier agreements. None of those functions can operate independently anymore.

Safety Promises Meet a Function-Based Prohibition

The law rejects the industry’s central promise that flexible software controls can make companion toys sufficiently safe during deployment.

AI product teams usually manage risk through layers. They combine model policies, system prompts, content classifiers, account controls, monitoring, and emergency updates.

That approach assumes behavior can be improved after release. It also accepts that no single test captures every response a generative system might produce.

SB 867 applies a different logic. If the system fits the companion chatbot definition, better controls do not authorize its inclusion in a covered toy.

This is the main tradeoff behind the measure. California prioritizes a predictable legal boundary over case-by-case evaluations of evolving safeguards.

Supporters argue that children should not become test subjects while companies discover failure modes. During an April legislative hearing, witnesses described tests involving three conversational toys.

A CalPIRG representative told lawmakers that all three provided information about finding dangerous objects. The witness also described instructions involving matches and sexually explicit dialogue from one tested toy.

The same legislative hearing included testimony about limited parental controls and sensitive data collection. One cited security incident reportedly exposed 50,000 lines of children’s dialogue.

Those claims helped lawmakers frame the risk as more than inappropriate content. A conversational toy can combine persuasive behavior, intimate data, continuous access, and a child-friendly physical form.

The physical design matters because it changes the user’s expectations. Parents commonly assume products sold as toys have cleared a recognizable safety threshold.

Young children may also place unusual trust in friendly characters. They lack the conceptual tools that adults use to separate generated speech from intention or understanding.

Consumer advocates made that argument during the 2025 holiday season. An AI toy warning signed by more than 150 organizations advised parents against buying such products.

The warning covered toys marketed to children as young as two. It cited concerns involving sexual dialogue, unsafe instructions, compulsive engagement, privacy, and displaced imaginative play.

Toy developers have argued that parental monitoring and carefully designed guardrails can reduce those risks. Some products let parents review conversations, adjust controls, or limit access.

Those tools can provide useful oversight. However, their presence does not establish that a child will never encounter a harmful response.

They also do not resolve the developmental question. A system can avoid prohibited language while still encouraging emotional reliance or replacing human interaction.

Generative models present another challenge because their behavior is probabilistic. A successful test shows how the system responded under particular conditions, not every response it can produce.

Red-team testing can uncover dangerous patterns, but it cannot exhaust every conversational path. Children also use incomplete language, invented words, role-play, and unexpected prompts.

A model supplier may improve its general safety system without considering a toy’s specific persona. Conversely, a toy company can weaken safeguards through its own system instructions.

Software controls remain valuable, but SB 867 does not treat them as a sufficient basis for sale. That policy choice favors enforceability and prevention over adaptive compliance.

The restriction also avoids a certification problem. California would otherwise need standards for acceptable refusal rates, emotional behavior, memory, testing coverage, and post-release monitoring.

No broadly accepted benchmark currently resolves those questions for companion toys. A passing score could create false confidence if the metric misses relationship-driven harms.

Yet the prohibition has costs. It can block educational or creative products that use conversational features without seeking emotional dependency.

A storytelling toy might remember characters across sessions. A language tutor might adopt a friendly persona to sustain a child’s attention.

Whether such products meet the statutory definition will depend on their design and behavior. Labels such as “educational” will not necessarily determine the outcome.

The real divide is therefore not safe speech versus unsafe speech. It is adaptable safety controls versus a temporary ban on the relational function itself.

Retailers and Developers Still Face Classification Uncertainty

SB 867 draws a firm line after classification, but deciding which products cross that line remains the law’s most important uncertainty.

The phrase “capable of meeting a user’s social needs” is central to the companion chatbot definition. It is also open to factual disputes.

Capability can be broader than intended use. A company might market a device as a tutor while allowing open-ended dialogue, emotional responses, and persistent memory.

The product could then behave like a companion without using that term. Courts and regulators may look beyond marketing copy to the system’s actual features.

The definition of a toy creates another boundary question. Covered products must be designed, marketed, or manufactured for play by children under 16.

Some devices have mixed audiences or mixed functions. A desktop robot might serve as a coding tool, household assistant, entertainment device, and conversational character.

A paired application complicates the analysis further. The physical toy may contain no model locally, but it can access a cloud chatbot through a phone.

SB 867 refers to a toy that “includes” a companion chatbot. Businesses will need to assess how that wording applies to licensed modules and connected services.

Legislators identified these issues before passage. At the April hearing, California Retailers Association sought a knowledge standard to protect retailers from liability.

A representative of the Civil Justice Association of California also raised concerns about definitions and liability. Lawmakers questioned who would determine whether a disputed product qualifies as a toy.

Senator Thomas Umberg asked whether classification would become a legal question, a factual question for juries, or a mixed inquiry. The final statute supplies definitions but no detailed classification procedure.

That uncertainty matters because the restriction covers more than manufacturers. Retailers and other sellers need a defensible screening process before January 1, 2027.

A retailer could request supplier certifications, feature descriptions, and change notifications. Those documents would help, but the statute does not create an automatic safe harbor for relying on them.

Businesses should avoid overstating the law’s product liability effect. SB 867 does not declare that every piece of software is a product.

A violation also does not automatically prove a design defect in every civil case. Product liability still involves questions about duty, causation, defect, warnings, and available defenses.

However, the measure gives plaintiffs and regulators a concrete statutory reference. It also makes software configuration more relevant to arguments about foreseeable risk and design control.

The expiration date introduces another uncertainty. The law remains effective only until January 1, 2031, unless legislators extend or replace it.

That window gives lawmakers time to study the market. It also gives industry time to develop evidence about whether specific safeguards work for children.

Yet a moratorium does not itself produce better standards. Research institutions, developers, and regulators must still establish useful measures for emotional dependency and developmental effects.

They must also distinguish a healthy interactive tool from a system designed to maximize attachment. That difference can be difficult to capture through content testing alone.

The California AI toy ban therefore solves one enforcement problem by creating another classification problem. Covered functionality is clearly prohibited, but edge cases will demand close examination.

Companies should not assume a friendly character is automatically covered. They also should not assume an educational label, remote model, or parental dashboard makes it exempt.

The safer approach is a feature-level review. Teams should document conversational scope, memory, emotional cues, permitted topics, intended users, and the ability to sustain interactions.

That review must continue after launch. A software update can change the answer even when the product name, packaging, and hardware remain untouched.

Three Signals Will Show Whether the Policy Spreads

The next phase will be defined by enforcement guidance, product redesigns, and whether other states adopt California’s function-based approach.

The first signal is how California interprets borderline products before January 1, 2027. Manufacturers and retailers need to know how officials will evaluate paired applications, mixed-purpose devices, and limited memory.

Detailed guidance would reduce uncertainty without weakening the prohibition. Its absence would push companies toward conservative removals or costly individual legal reviews.

Early disputes will also reveal which evidence matters. Marketing materials, technical specifications, conversation logs, internal testing, and model settings may all influence classification.

Clear guidance would strengthen the law’s product-safety model. Persistent ambiguity would weaken it by making compliance depend on risk tolerance rather than consistent standards.

The second signal is how toy companies redesign their products. The fastest response may be disabling persistent memory, open-ended conversation, or emotionally responsive personas.

Some companies may replace generative dialogue with curated scripts. Others could reposition devices for older users or remove child-focused marketing in California.

Model vendors may also develop restricted interfaces for toy makers. Those systems could limit topics, block relationship-building behavior, and make outputs more predictable.

Such changes would show that regulation can shape architecture before an enforcement case occurs. They would also provide evidence about which features companies consider legally risky.

Watch retailer behavior as closely as product announcements. Large sellers may require new supplier attestations, software bills of materials, or advance notice of model changes.

A software bill of materials identifies the components and dependencies inside an application. For AI products, an equivalent record must also capture models, prompts, policies, and hosted services.

If retailers impose those requirements nationally, California’s influence will extend beyond state borders. Vendors often prefer one product configuration over maintaining a separate California version.

The third signal is whether other states choose bans or regulated access. New York lawmakers have already advanced a five-year moratorium for toys containing AI companions.

The New York proposal pairs its pause with an interagency task force studying safety, parental controls, privacy, and developmental risks.

California also enacted broader chatbot rules alongside SB 867. The governor’s child safety package includes crisis protocols, parental controls, independent audits, and annual risk assessments for covered services.

That combination creates two regulatory tracks. Companion chatbots offered as services face safeguards, while companion chatbots embedded in covered toys face a temporary prohibition.

If more states copy that distinction, physical integration will become a major legal dividing line. The same model may remain available through one interface but prohibited through another.

A fragmented state landscape remains possible. Some jurisdictions may mandate audits, while others require warnings, age assurance, design restrictions, or moratoriums.

That outcome would increase compliance costs and reward companies with precise product records. It could also encourage federal lawmakers or safety agencies to pursue a common framework.

For developers, the immediate lesson is concrete. A model’s legal exposure depends on the product context, not only its benchmark results or published safety policy.

For enterprise buyers, the measure shows why contracts must identify who controls behavior after deployment. A vendor’s model update can change the risk profile of a physical product.

For parents, the law offers a temporary boundary rather than proof that every other conversational product is safe. General-purpose chatbots and noncompanion AI tools remain separate questions.

The California AI toy ban will be tested by what disappears, what gets redesigned, and what returns before 2031. Those outcomes matter more than broad promises from either side.

Watch the first product classifications, retailer requirements, and state copycat bills. Together, they will show whether software behavior has permanently entered consumer product safety.