Five US states — New York, California, Washington, Oregon and Hawaii — now legally require any “companion” AI chatbot to disclose that it isn’t human, and Colorado’s attorney general holds a public rulemaking hearing on its own version of the rule on 26 October 2026, with the requirements taking effect on 1 January 2027. If your page, or your agency, uses software to flirt, sext or chat with fans on your behalf without telling them, that growing pile of state law may already reach you — on top of the platform rule you’re probably already breaking.
Why it matters to creators
AI “chatter” tools aren’t a niche curiosity any more. Agencies have spent the last couple of years quietly rolling out software that drafts — or sends — sexualised messages to subscribers so a human chatter doesn’t have to. OnlyFans’ own terms of service ban AI-written direct messages outright, which already puts the legal risk on the creator’s account, not the software vendor’s. Now a second, separate layer of risk is stacking on top: a wave of US state “companion chatbot” laws written to stop AI systems from pretending to be a person in an ongoing relationship with a user — and at least two of them carry real money behind a breach, not just a warning letter.
Which states, and what they actually require
New York’s AI Companion Models law has been in force since 5 November 2025. California’s SB 243 took effect on 1 January 2026. Washington’s HB 2225 and Oregon’s SB 1546 both become fully operative on 1 January 2027, and Hawaii has also enacted a version. All of them share a common core: a chatbot that holds itself out as capable of an ongoing, personal relationship with a user must clearly disclose, at the start of the interaction, that the user is talking to AI, not a person — with repeat reminders (every three hours, in most versions) during long sessions.
The penalties aren’t symbolic. Oregon and California both give users a private right of action: the greater of actual damages or $1,000 per violation, plus attorneys’ fees, on top of any state enforcement. New York’s Attorney General can pursue civil penalties of up to $15,000 per day for an ongoing breach. Colorado’s Chatbot Safety Act (HB 26-1263) is still being finalised — the state’s Attorney General released a revised interim draft on 6 October 2026, with the public hearing set for 26 October and operator duties starting 1 January 2027.
Would your chat tool actually count?
This is the part nobody selling you the software is going to flag. The laws differ on exactly what counts as a “companion chatbot,” but several definitions are broad enough to catch exactly the kind of tool agencies already use. Oregon’s law covers any AI system “designed to simulate a sustained, human-like platonic, intimate or romantic relationship or companionship with a user.” Washington’s covers a system that can “sustain a relationship across multiple interactions” through adaptive, human-like responses, according to a summary of both laws from Mayer Brown. Read that against how some of this software is actually marketed to agencies — one US tool, FlirtFlow, was sold on creating “authentic connections,” and was reportedly used across roughly half of a 70-creator agency’s roster plus dozens more creators elsewhere, according to earlier reporting on the agency AI-chat market — and the overlap with “simulating an intimate relationship” isn’t a stretch.
There’s no test case yet applying these laws specifically to paid fan-platform messaging, so nobody can tell you with certainty how a court would rule. But the statutory language, as written, doesn’t carve out adult or fan-platform chat, and it applies based on where the user is sitting — not what platform the message came through or what kind of content is on your page. If a meaningful share of your subscriber base is in New York, California, Washington, Oregon, Hawaii or (from next year) Colorado, the geography alone may already put you in scope.
The platform problem you already have
Even before any state law gets involved, you have an existing contractual problem: OnlyFans prohibits AI-authored messages in its terms, and the company has said creators remain legally responsible for interactions on their own accounts, regardless of who — or what — is actually typing. That means an agency’s AI chat tool is already a platform-suspension risk sitting on your account, separate from anything a state attorney general might do. Layering a consumer-protection statute with a $1,000-per-violation private right of action on top of that isn’t a hypothetical inconvenience; for a chatbot sending thousands of undisclosed messages a month, the exposure scales fast, and it’s the creator’s name on the account, not the software vendor’s.
What to do now
- Ask your agency directly whether any part of your DM or chat handling uses AI-generated text, drafted or sent, and get the answer in writing.
- Check your management contract for who carries legal and financial liability for third-party chat software — if it doesn’t clearly say “the agency,” push to have that added before you sign anything new.
- If fans in New York, California, Washington, Oregon or Hawaii make up a meaningful share of your subscribers, treat disclosure as a requirement now, not a 2027 problem.
- Watch Colorado’s 26 October rulemaking hearing and the final text of HB 26-1263 — the definition of “conversational AI service” it lands on could expand or narrow who’s covered well beyond adult platforms.
- Remember that state disclosure law is a second risk layered on top of OnlyFans’ existing ban on AI-written DMs — fixing one doesn’t fix the other.
This is general information, not legal advice — speak to a qualified lawyer about how these laws apply to your specific business and subscriber base.
It’s also worth remembering that the human alternative to AI chat tools has its own well-documented problems: the BBC’s investigation into OnlyFans chatters found some earning under $2 an hour, which is part of why agencies reached for automation in the first place. Licensing your likeness to an AI “digital twin” platform carries its own separate set of contract risks, which we’ve covered in detail here — and if you’re vetting a management agency generally, our guide to agency red flags is a useful place to start before you sign. For a sense of why creators reach for any help with the message load at all, one of ours wrote about running every part of the business solo while working three jobs before the account took off.
