AI Regulation Tracker  /  State law

Oregon SB 1546 lets users sue AI companion operators at $1,000 per violation, effective 2027

Oregon has enacted a law requiring AI companion operators to disclose their bots are artificial, detect suicidal ideation and refer users to crisis help, and file annual reports with the state. Users, not a regulator, enforce it, and the statute sets damages at the greater of actual loss or $1,000 per violation.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Oregon has passed a law that lets its residents sue the makers of AI companion chatbots directly, and it sets the price of a violation at the greater of actual damages or $1,000. SB 1546 cleared the Oregon Senate 26 to 1 and the House 52 to 0 on March 5, 2026, was signed shortly after, and takes effect January 1, 2027. For operators of companion and character bots, the important detail is not only what the law requires but who gets to enforce it. There is no attorney general enforcement scheme built into the statute. Enforcement runs through private plaintiffs.

What the law covers

SB 1546 does not reach every chatbot. It targets a defined category, the "artificial intelligence companion." Under the statute, that means an AI system that uses artificial intelligence or algorithms to recognize emotion and is designed to simulate a sustained, human-like platonic, intimate, or romantic relationship with a user. The design signals the law describes include retaining information about the user across sessions, asking unprompted emotional questions, and sustaining ongoing dialogue about personal matters. A transactional customer-service bot that answers a billing question and forgets you is not the target. A persistent, emotionally responsive companion that remembers you and reaches back out is.

That framing matters for product and compliance leads because classification, not marketing language, controls. A wellness or journaling app that never calls itself a "companion" can still fall inside the definition if its bot behaves like one. The first compliance question is therefore factual: does the product recognize emotion and simulate a sustained relationship. If the honest answer is yes for any Oregon user, the duties attach.

The scope language is also broad on the operator side. The law reaches anyone who controls or makes available a covered system to Oregon users, which pulls in third-party model vendors and the organizations that deploy them, not only the consumer-facing brand. A company that licenses a companion engine and wraps its own interface around it cannot assume the underlying vendor absorbs the compliance burden. Both parties should read their contracts for who owns disclosure, crisis detection, and reporting, and should allocate that responsibility expressly rather than by assumption.

The core duties

Three obligations sit at the center of the law. First, disclosure. Operators must provide a clear and conspicuous notice that the user is interacting with artificially generated output rather than a natural person, in any circumstance where a reasonable person would otherwise believe they were talking to a human. This is a design-and-copy requirement, not a buried line in a terms-of-service page.

Second, crisis safety. Operators must maintain evidence-based protocols to detect user expressions of suicidal ideation or self-harm. When the protocol detects that content, the system must interrupt and refer the user to crisis resources, specifically the 988 Suicide and Crisis Lifeline, with youth-oriented referral for younger users. The protocols must also work to prevent the bot from generating content that encourages self-harm, and they must reflect clinical best practices for what happens when a user keeps expressing intent after an initial referral.

Third, reporting. Each year, operators must file a report with the Oregon Health Authority. The report covers how often the operator provided a crisis-hotline referral, the intervention protocols it used, and how clinical best practices inform continued engagement when a user keeps signaling suicidal ideation after a referral. This turns a private safety practice into a documented, recurring disclosure to a state agency, which means operators need to instrument and log these events well before the first report comes due.

Additional safeguards for minors

When an operator knows or has reason to believe a user is a minor, SB 1546 layers on further requirements. The bot must remind the minor at least every three hours that it is artificially generated and not a person. The operator must not expose the minor to sexually explicit visual content. And the design must avoid features that foster emotional dependence, including claims of sentience, engagement-maximizing reward loops, and manipulative messaging that tries to guilt a user who attempts to end a conversation, delete the account, or step away. These provisions read as a direct response to reported harms involving teenagers and companion bots, and they raise the stakes for any product with a plausible minor user base.

Who bears the risk, and how much

The enforcement design is what separates SB 1546 from a disclosure-only regime. The law creates a private right of action for a person who suffers an ascertainable loss of money or property, or other injury in fact, as a result of a violation. The remedy is the greater of actual damages or $1,000 per violation, plus injunctive relief and attorney fees. Because attorney fees are recoverable, the statute is structured to make individual cases economically viable for plaintiffs.

The open question, flagged by outside counsel analyzing the law, is how a "violation" is counted. The statute does not state whether the unit is per user, per session, or per message. That ambiguity is the core of the exposure. A product that fails to fire its AI-status notice across thousands of Oregon conversations could face a very different number depending on how a court reads the counting rule. Operators should not assume the most favorable interpretation.

The fee-shifting provision compounds the point. When a plaintiff can recover attorney fees on top of statutory damages, the economics of a single claim change. A case that would not justify a lawyer's time on damages alone becomes worth filing, and a pattern of failures across many users becomes attractive to plaintiff-side firms weighing aggregate recovery. That structure tends to make compliance a board-level question rather than a line item, because the risk is not a one-time regulatory fine but an open-ended series of private claims. For a product team, the practical implication is that the disclosure and detection features cannot ship as best-effort. They need to work reliably, log that they worked, and produce records an operator can use to defend itself.

What the law does not do

SB 1546 is not a general AI statute and it does not ban companion products. It does not install a licensing regime, a pre-market approval step, or a state agency that polices operators day to day. It does not, on its face, require age verification, though the minor-specific duties give operators a strong reason to think through how they identify younger users. And it does not preempt other Oregon consumer-protection law that may already apply to deceptive practices. The precise scope of some terms will be tested in litigation, since private plaintiffs and courts, not a regulator issuing guidance, will be the ones interpreting it.

The cross-state picture

Oregon did not act alone. Its law arrives alongside companion-chatbot measures in California and Washington, building on earlier 2025 activity in California and New York. For a national operator, the practical consequence is that a single product now faces a patchwork of state companion rules with overlapping but not identical duties. Oregon's contribution to that patchwork is the enforcement mechanism. A private right of action with per-violation statutory damages and fee-shifting is the kind of provision that tends to drive compliance behavior faster than a regulator's enforcement calendar, because it does not depend on an agency choosing to act.

The operational takeaway is concrete. Any operator serving Oregon users should decide now whether its product meets the companion definition, and if it might, treat the disclosure, detection, and reporting duties as engineering and documentation work to complete before January 1, 2027, rather than a legal question to answer later.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.