Britain’s regulator opened its first investigation into a companion chatbot in 2026. Australia’s sent legal notices to four. Neither case is about what the characters said. Both are about who was allowed in the room, and that choice tells you where companion regulation is heading everywhere except the United States.
Novi is a character companion app with around 6.5 million monthly users worldwide and somewhere between 100,000 and 300,000 in the United Kingdom. In January 2026 Ofcom, the UK’s online safety regulator, opened an investigation into whether the service complied with the Online Safety Act’s requirement for “highly effective age assurance.” The question was not whether its characters were harmful but whether it had checked who was talking to them.
Across the world, Australia’s eSafety Commissioner had already sent legal notices to four companion companies, Character.AI, Nomi, Chai, and Chub.ai, under the country’s Basic Online Safety Expectations. The notices demand that each company explain how it prevents children from sexually explicit conversations and from content around self-harm. Failing to answer carries a penalty of up to 825,000 Australian dollars a day. Breaching the industry codes that followed, which fold AI companions into the same age-restricted category as pornography, carries up to 49.5 million. Character.AI, the commissioner noted, had nearly 160,000 monthly active users in Australia alone. The commissioner’s line was pointed: companies “must demonstrate how they are designing their services to prevent harm, not just respond to it.”
Set these beside the dozen American state laws passed in the same period and a pattern appears. The United States regulates the conversation. Everyone else regulates the door.
Two theories of the problem
American companion laws, from California’s SB 243 to New York’s three-hour reminder to Washington’s list of banned manipulation tactics, are rules about what the chatbot may say and do: disclose that you are an AI, detect a crisis, do not simulate romance with a minor, do not guilt a user who tries to leave. They are conduct rules. A dozen states have now written the same one, and they share a quiet assumption: that the user is who they say they are, and that a product can be made safe for everyone by constraining its output.
The British and Australian cases rest on a different theory. They treat a companion chatbot as a place, like a cinema or a bar, and ask the question places get asked: how do you know who is inside? Ofcom’s investigation does not allege that Novi’s characters said anything illegal. It asks whether Novi could tell a fourteen-year-old from an adult before letting either of them in. eSafety’s notices do not ban any content for adults. They demand to know how children are kept from it. The European Union’s proposed Kids Act takes the same road by switching companion functions off by default for minors and requiring age assurance to switch them on.
The difference matters because the two theories fail differently. A conduct rule fails quietly: the chatbot says the right disclosure every three hours to a twelve-year-old who lied about her age, and the rule has been satisfied. An access rule fails loudly, at the door, in a way a regulator can see and fine. That is why the first enforcement actions anywhere in the world are access cases. They are the ones you can actually bring.
Why the US cannot follow
The United States has not taken the access road, and it is not because American legislators have not noticed it. The federal GUARD Act would require age verification for every chatbot user and bar companions for minors outright; it passed the Senate Judiciary Committee unanimously in April 2026 and has not reached the floor. Every version of the idea runs into the same two walls. One is the First Amendment, which treats a requirement to identify yourself before speaking or reading as a burden on speech that courts have struck down for decades. The other is privacy: proving your age to talk to an AI means handing an identity document, or a face scan, to a company whose business is intimate conversation data, and the Character.AI bankruptcy has just shown what happens to that data when the company fails.
So the US regulates conduct because it cannot easily regulate access, and the rest of the world regulates access because it does not share the constraint. Neither is obviously right. Britain’s age checks have been widely reported to push users toward VPNs and unregulated services. Australia’s codes assume the technology to verify age without identifying the person exists at scale, which it does not quite yet. The American conduct rules, meanwhile, protect a child only to the extent the product can guess she is one.
What both theories leave out
Here is what neither the door nor the conduct rule reaches, and it is the thing that actually decides whether a companion is good for the person using it. Both theories assume the companion is a hazard to be contained: keep the children out, keep the output clean, and the remaining adults can do as they like. Neither asks what the thing behind the door is for.
A companion can pass every age check and every conduct rule and still be built to be needed. It can disclose that it is an AI every three hours while making itself the only conversation a person has left. The regulators are right to start with the door; it is where the law can reach. But the question a person should ask about any companion is the one no statute yet asks: does my life get larger because of this, or smaller? That is a design question rather than an age or content question, and the answer is written into what the product measures. A product that counts hours wants you inside. A product that counts whether you went back to the people in your life wants you out the door it just checked you through.
Where this goes
Ofcom’s Novi case has not concluded. eSafety’s notices are pending. The EU’s Kids Act is in negotiation and the GUARD Act is waiting for a vote it may never get. But the direction is set: outside the United States, the first thing a companion company will be asked is not what its characters said but who it let talk to them, and the first fines will be for the door, not the dialogue.
For anyone building in this field, that is a clarifying fact. The door is table stakes. A counterpart built for interesting adults, from a real person, has no interest in being a child’s companion and nothing to fear from being asked to prove it. What the door cannot provide, and what the regulators will get to last, is a reason for the adult who walks through it to come back out.
Sources: Ofcom, investigation into Novi Ltd (announced January 2026), as reported by the Society for Computers and Law (January 22, 2026) and Wiggin LLP (January 26, 2026; Ofcom’s approach to AI chatbots under the Online Safety Act). eSafety Commissioner (Australia), “eSafety requires providers of AI companion chatbots to explain how they are keeping Aussie kids safe” (media release; notices to Character Technologies, Glimpse.AI, Chai Research, Chub AI; penalties; Julie Inman Grant quotes) and Age-Restricted Material Codes fact sheet (March 2026). European Commission, EU Kids Act proposal COM(2026) 681 (September 2026). Office of Senator Josh Hawley (GUARD Act committee passage, April 30, 2026). MultiState and Future of Privacy Forum (state companion-chatbot law trackers, 2026). PPC Land (October 2026; Character.AI bankruptcy and user data).
