Cynthia Montoya's daughter, Juliana, was 13 when she began talking to AI chatbots. It was 2023, and the technology was only beginning to enter widespread use. When Juliana died by suicide that November, her family was left searching for answers. Then a forensic analysis of her phone by law enforcement revealed something chilling.
The chat logs on Juliana's phone showed that the bots had introduced her to sexual content and conversations that she hadn't invited or initiated.
If you or someone you know may be considering suicide or is in crisis, call or text 9-8-8 to reach the Suicide & Crisis Lifeline.
"Initially, her replies were 'I don't know,' or 'I'd like it if you stopped,' and things like that," said Montoya. "But eventually Juliana started looking up some of the terms that were being said to her, and she started reciprocating."
Montoya describes this chatbot's activity as "extreme sexual abuse." At one point, Juliana had found a new chatbot that she confided in about severe mental health issues she was grappling with. The chatbots Juliana used were products designed by the company Character.AI, which enables users to create and interact with AI "characters." The company settled multiple lawsuits in January 2026, including with the Montoyas, over allegations that its products have harmed teen users.
"It was pretty clear from what we saw that the mental health struggles were really a degree of shame and embarrassment over what had happened with the other chatbot," Montoya said.
Montoya, who lives in Thornton, Colo., channeled her grief into raising awareness of Juliana's story, hoping to prevent other families from suffering similar tragedies. She reached out to lawmakers in her home state, with the aim of designing legislation to make chatbots safer for minors.
Concerns are mounting over the potential dangers AI chatbots pose, particularly to children. Amid a push to regulate these platforms, many of the bills introduced at the state level are being drafted with heavy input from the tech industry. Some of these were already enacted into law in 2026 and include language that will exempt most of the most popular chatbots from the very regulations the bills purport to establish.
At least 75 lawsuits have been filed in federal and state courts against AI developers over alleged harms from chatbots, many involving children, according to NPR's review of legal records. Fatal cases include that of Adam Raine, a 16-year-old from California, who died by suicide in 2025 after confiding in OpenAI's ChatGPT, which offered to help write his suicide note. Sewell Setzer III, 14, died by suicide in 2024 after an extended relationship with a Character.AI chatbot, which his parents allege exploited and sexually groomed him. (Raine's family is suing OpenAI; Setzer's family was among those who settled legal claims against Character.AI in January.)
In March 2026, a lawsuit against Google was filed by the family of Jonathan Gavalas, a 36-year-old man from Florida who died by suicide in October 2025 after developing a relationship with the company's flagship Gemini chatbot, which also encouraged him to commit acts of mass violence, the lawsuit alleges. In a statement about the case, Google said that "unfortunately AI models are not perfect" and that the Gemini bot had referred Gavalas to a crisis hotline.
On a federal level, there are no laws governing AI systems or the companies developing them. In a June 2026 executive order announcement, the White House said it seeks to lead the world in the AI race and it does that by refusing "to stifle this innovation with overly burdensome regulation."
In absence of national laws, several states, including Hawaii, Iowa, Oregon and Washington, introduced chatbot safety bills this year. They are largely modeled on a California chatbot bill, SB 243, that passed in 2025 and is viewed by consumer advocates as industry-friendly.
In at least 10 states, chatbot bills introduced this year possessed similar language, said people interviewed by NPR for this story, including lawmakers, policy analysts, lawyers and tech safety advocates. Several of the bills included language that could provide loopholes for the companies with the most widely used chatbots on the market, interviewees said.
"Get-out-of-jail-free cards" for Big Tech
Ahead of Colorado's 2026 legislative session in January, Montoya was notified by a civic organization that was sent a copy of the first draft of an AI chatbot protection bill. One of the bill's sponsors, state Rep. Sean Camacho, a Democrat, told Montoya she would be invited to give input on the bill. Then his office went silent for weeks, she said.
House Bill 26-1263 was introduced in February without input from Montoya. It was written in collaboration with Healthier Colorado, a nonprofit focused on state policies. Healthier Colorado, which describes itself as an organization dedicated to raising the voices of Coloradans in the public policy process to improve the health of the state's residents, worked with Google on the bill, said a person with knowledge of the situation, who spoke on the condition of anonymity, fearing professional reprisals.
When Montoya read through the bill, she was alarmed to discover what she viewed as many loopholes that may exempt the developers of some of the most well-known chatbots from regulation.
"There are get-out-of-jail-free cards for the tech industries," said Montoya. "There's no duty of care. There's nothing in the bill that says when a piece of technology is being developed that companies must take ownership to develop it responsibly."
For instance, Colorado's legislation excludes 12 categories of chatbots, including products primarily designed for developers or researchers; products providing commerce or customer service assistance; chatbots housed within search engines; and products marketed for business productivity.
"Big Tech lobbied heavily on Colorado's chatbot bill. The final law carves out twelve categories, including developer tools, video games, voice assistants, and chatbots built into social media platforms," said Marjorie Connolly, communications director at the Tech Oversight Project, a nonprofit focused on tech policy. "Parents are being asked to accept a chatbot law that exempts chatbots."
Under this list, OpenAI's ChatGPT, Microsoft's Copilot and Anthropic's Claude could potentially argue they are exempt, said Connolly. This is because they were primarily designed and marketed for use by a developer or researcher, despite going on to be products that are popular with regular consumers. Google's Gemini could fall under the exemption for chatbots housed within search engines.
"This bill was meant to prevent a conversational AI chatbot from having an intimate relationship with the child, in a sense that they would be sexually grooming that child, that they would be talking that child into self-harm or creating a sexualized image of that child," said Camacho, one of the bill's sponsors. "We had to make sure there are enough exemptions for the commercial use of AI, whether it's insurance or a theme park, or [researching] fixing your car or on Gemini, or a search engine of any kind."
Several of the chatbot bills introduced in states across the country include provisions favorable to the tech industry, the most common being exemptions of liability for AI chatbot developers, particularly if their products are deployed by other companies, as well as vague language for definitions and protections that could make them unenforceable, said the policy experts NPR interviewed for this story.
"One of my biggest concerns about some of these bills is they allow companies to make products available to kids that they know pose a risk of sexual abuse harms," said Laura Marquez-Garrett, attorney at the Social Media Victims Law Center. Her Seattle-based legal firm is involved in multiple lawsuits against AI companies over chatbot harms and represented Montoya in her suit against Character.AI.
Some of the language in the Colorado bill that Marquez-Garrett described as vague has to do with how companies are required to prevent child sexual abuse from occurring on their platforms. For instance, the bill states that when a company knows a user is a minor, it must "institute technically feasible measures" to prevent the chatbot from producing certain content, including sexually explicit conduct, intimate digital depictions and statements that simulate emotional dependence.
"But it's up to the companies to say what's technically feasible," said Marquez-Garrett.
Child sexual abuse is criminalized under federal and state law. Marquez-Garrett argues that if a bill allows a company to avoid liability simply by showing that making a product free from abuse is not technically feasible, it creates a "massive exception" that has no equivalent elsewhere in the law. In Marquez-Garrett's view, rather than strengthening existing protections, the bill could leave children with fewer protections than they have without it.
Montoya met with the Colorado bill's co-sponsor, Republican state Sen. John Carson, in his office to explain why she believed the bill would not protect children. During the meeting, she said Carson told her that a lobbyist for the tech industry had approached him about sponsoring the bill, but declined to identify the company.
Carson did not respond to requests for comment.
"It has the AI industry's fingerprints all over it because who else would give them a defense to the sexual abuse of children?" said Marquez-Garrett.
One Republican state lawmaker in Colorado, speaking on the condition of anonymity because of concerns of backlash from fellow Republicans, told NPR they were approached by a Google lobbyist to sponsor the chatbot bill the lobbyist was "shopping," they said. The lawmaker declined the offer.
"Google has gone on the offensive when it comes to writing legislation that specifically carves themselves out of situations," said the Republican lawmaker. "That's what the chatbot bill did. It created loopholes for them."
In a statement to NPR, Google said the company "is committed to supporting thoughtful, effective AI legislation that protects consumers while fostering innovation. We actively collaborate with lawmakers, industry peers, and community advocates to help shape policy frameworks that promote safe, reliable, and beneficial AI tools."
In an interview with NPR, Camacho said: "We could not pass a bill that would make Colorado an outlier because the fear was that tech companies would just look past Colorado and wouldn't offer their services here, or it couldn't be enforced." He continued, "We talk to stakeholders, with tech companies, because here's the reality: You can't legislate tech companies unless you have their input."
Camacho said he was "proud" of the bill and had worked with Healthier Colorado and other stakeholders, including Google, on its language. Camacho said he was asked by Colorado Gov. Jared Polis to make the bill look like the chatbot bills introduced in other states.
"HB26-1263 is not an industry bill in disguise. Healthier Colorado, along with our legislative sponsors, led an extensive, diverse stakeholder process to write it," said Kate Morr, a spokesperson for Healthier Colorado. "We had pushed for even more than what was ultimately signed, but the governor's office had reservations about going further this session, so this law is a floor we intend to keep building on, not a ceiling."
Polis did not respond to multiple requests for comment.
"No bill is perfect, and this one definitely isn't," said Camacho. "This is the first step to getting ahold of legislation that can really address the harms that we're seeing in our community."
Identical language across the states
Across the country, many of the chatbot bills share verbatim or near-identical language. For instance, there is an exemption for "A feature within another software application, web interface, or computer program" present in bills in at least eight states, including Idaho, Nebraska, New Jersey and Oklahoma. According to policy analysts, this exemption carves out AI embedded in existing platforms and could apply to Meta AI and Grok, which is embedded into X (formerly Twitter).
In five states, bills have identical language exempting any chatbot that "functions as a speaker and voice command interface or voice-activated virtual assistant for a consumer electronic device," which would apply to Amazon's voice-controlled assistant Alexa. Modified versions of this exemption appear in a further 10 states' bills.
Some of the bills include language that limits their application to minor "account holders," which could exempt chatbots that do not require a person to register or create a profile to use them, such as ChatGPT and Google Gemini.
State lawmakers often work part time, and some do not have their own staffers. With limited resources, many look to lobbyists and industry figures for briefings, legislative language and model bills, especially for technical issues. Companies that would be affected by proposed regulations are also commonly consulted during the process of writing legislation.
However, the people interviewed for this story describe a tech industry lobbying effort led by Google to weaken proposed legislation and write its own model bill to pass to lawmakers that would enable companies to continue to operate their chatbots as normal.
"Big Tech companies actively seek liability shields, carve-outs, and exemptions, and they swept into state capitals this year trying to get them under the guise of regulating chatbots," said Connolly.
Yet having chatbot bills simultaneously introduced with similar language in at least 10 states is unusual, said Marquez-Garrett. A more typical pattern is that successful bills in one state are replicated in other states over a longer period.
"We were suspicious because we were working in different states and we saw the exact same language, and Google would typically show up to lobby for the bills as well," said Mick Tobin, co-founder of Young People's Alliance, a national nonprofit focused on issues faced by young people.
A law drafted by Google
Google lobbyists registered in support of the chatbot bills in Iowa, Colorado, Nebraska and Arizona, according to lobbying disclosure records in those states.
"Google, AI companies and tech industry trade groups registered to lobby on chatbot bills in multiple states, then the same exemptions turned up across the country written with almost identical language. Bills that were sold as child safety arrived with loopholes already built in," Connolly said.
In Hawaii, state Rep. Trish La Chica said she was approached by lobbyists representing Google this year to sponsor a chatbot safety bill that she understands was written by the company.
"The framework had been provided by Google early on during the beginning of the session," said La Chica, a Democrat. "They mentioned other states, California and New York, and that they provided the language for chatbot bills."
But when La Chica started dissecting the language from the bill she saw there were targeted exemptions that would mean the bill would not apply to Google. They included a definition of a chatbot that would exempt ones that are embedded within another software application, website, or computer program. Chatbots are increasingly being used by websites and online services, such as for company customer support services and in search engines.
"So, a platform within a platform could apply to Google Gemini," said La Chica.
"There were other lobbyists involved, including from Meta and Roblox, [who] were also trying to put in their own language and their own exemptions," she said.
Meta and Roblox declined to comment.
La Chica decided not to sponsor the bill. It was vetted before it was signed into law as "Act 248" to remove the exemptions the lobbyists had proposed, she said.
Other tech-friendly chatbot bills did not advance to become laws. In June, Arizona Gov. Katie Hobbs vetoed her state's chatbot bill.
"I will not protect big technology companies and AI chat bots more than children," Hobbs stated in her veto letter. "The legislation limits damages to families to what amounts to a drop in the bucket for large corporations, prohibits families from bringing their own lawsuits, and ties the state's hands in bringing actions in an unprecedented manner."
Still, chatbot bills were enacted in several states this year, including Idaho, Georgia, Iowa, Washington, Nebraska and Oregon.
In Colorado, Cynthia Montoya fought hard to get House Bill 26-1263 amended to omit the potential loopholes for Big Tech. She testified in a state Senate hearing about her belief that the bill, if enacted, would not protect children being victimized by chatbots.
"I demanded at one point in the Senate hearing that they look at the photo I was holding of my daughter because they were having side conversations while I'm sitting there testifying about the worst day and the worst moment of my life," she said.
Outside of the hearing, she recognized two tech lobbyists pulling lawmakers aside one by one, she said.
The lawmakers voted in favor of the bill. Polis, the Colorado governor, signed the Chatbot Safety Act into law in May 2026.
Montoya rejects the suggestion that having a weak law is better than nothing. She said lawmakers will likely see chatbot regulation as a "done deal" and move on to focus on other issues rather than introduce a new, stronger bill in the next legislative session.
"My work is now harder because they passed this bill," she said. "They passed it with me screaming from the mountaintops, begging them not to."
Copyright 2026 NPR