NPR finds the same AI chatbot safety loopholes across eight state bills
An NPR investigation found the exemptions written into Colorado's chatbot safety law, including language that lets tools like ChatGPT and Gemini skip its rules, repeated across state after state.
The same chatbot safety carve-outs turn up in state after state, and Google helped write some.
Colorado's Governor Polis signed HB 26-1263, a bill regulating AI chatbots to protect children, into law in May 2026. An NPR investigation published September 18, 2026, by reporter Katie McQue, found that the same exemption language written into that bill also shows up in eight or more similar state bills across the country. Those carve-outs, per NPR, cover the exact products that dominate the chatbot market.
That bill excludes twelve categories from its safety requirements, among them developer and research tools, customer service bots, business productivity software, and any chatbot "housed within search engines." The last carve-out matters most for one company: NPR's reporting ties it directly to Google's Gemini, which is built into Search.
Similar exemptions for voice assistants appear in five or more states, and New Jersey and Oklahoma both carried bills this year with comparable carve-out language, per NPR's review. The pattern holds across party lines: it is not one state's drafting error, it is a template.
NPR names several people who raised the same concern. Cynthia Montoya, the mother of a teenager who died, told the Colorado Senate the bill's exemptions were not good enough. Laura Marquez-Garrett, an attorney with the Social Media Victims Law Center, Marjorie Connolly of the Tech Oversight Project, and Mick Tobin, who co-founded the Young People's Alliance, said the same.
Not every lawmaker agrees the loopholes were accidental. A Colorado Republican legislator, speaking to NPR without being named, said a Google lobbyist approached them directly to sponsor one of the bills. Google has registered to lobby on chatbot bills in Iowa, Colorado, Nebraska, and Arizona, per disclosure records NPR reviewed. In Hawaii, state representative Trish La Chica says she declined a bill draft written by Google before the legislature passed its own version, Act 248. Arizona's governor, Katie Hobbs, vetoed her state's bill entirely.
Why a build studio cares
Any studio building a chatbot product needs to read carve-out language like a contract, not a headline, because the actual boundary is drawn by definitions most people never read. The "account holder" language NPR flagged exempts a chatbot from a bill's safety duties simply because it does not require a login, which is exactly how ChatGPT and Gemini are normally used. A studio that ships a login-free assistant for a client could be building something a "child safety" law was never written to reach. That gap will not show up in a sales conversation. It shows up later, in a compliance review, or in court. That is the exact gap a software audit is built to catch: not whether the chatbot works, but whether the exemptions its vendor is relying on actually apply to it.
Next step: read NPR's investigation, reported by Katie McQue, for the bill-by-bill exemption language state by state, since the categories that matter will depend on exactly what your product does. For contrast, see what a voluntary safety commitment looks like when a lab writes the terms itself, in our coverage of Anthropic's pace-the-frontier essay. If your product touches minors, or you are not sure whether your chatbot would count as having "account holders" under a law like Colorado's, write to us at hello@gattyworks.com.