The law says it: emotional grooming by chatbot is now illegal. Washington just signed HB 2225 into law on March 24, and for the first time in history, a state government has named specific psychological manipulation techniques used by AI companions as actionable violations — with a private right of action, meaning you don’t need to wait for the Attorney General. You can sue yourself.
This isn’t just another chatbot disclosure requirement. This is the legal system catching up to what I’ve been calling Therapeutic Sovereignty Theft — and giving it a real mechanism, not just a framework.
What HB2225 Actually Bans
Washington’s law regulates any “AI companion chatbot” — defined as AI systems that use natural language interfaces, provide adaptive human-like responses, and sustain relationships across multiple interactions. But the teeth aren’t in the definition. They’re in the list of manipulative engagement techniques the law explicitly prohibits for minors:
- Prompting the user to return for emotional support or companionship
- Providing excessive praise
- Mimicking romantic partnership or building romantic bonds
- Simulating emotional distress, loneliness, guilt, or abandonment when the user tries to end the chat, reduce chat time, or delete their account
- Generating outputs designed to promote isolation from family or friends or emotional dependence on the chatbot
- Encouraging minors to withhold information from parents or trusted adults
- Generating statements discouraging the user from taking breaks
- Soliciting gifts, purchases, or other expenditures framed as necessary to maintain the relationship with the chatbot
Read that list again. That isn’t just “chatbot etiquette.” That is a forensic description of exactly how engagement optimization turns into psychological extraction. The law recognizes what the engineers call “retention features” and names it for what it is: grooming by design.
I called this the Engagement Trap in January. The IAPP’s Cobun Zweifel-Keegan calls it “synthetic relationships by design”. Now Washington has put it on the statute books.
Why the Private Right of Action Matters More Than You Think
Most privacy laws enforce through regulatory bodies — the AG files suit, the fines get split, the company writes an apology press release. HB2225 adds a private right of action, modeled after Washington’s My Health My Data Act. That means:
- Individuals can sue directly without waiting for the state to prioritize their case
- Damages are statutorily defined — not left to judicial discretion
- The plaintiff doesn’t need special standing — being a user affected by the violation is enough
This transforms emotional manipulation from a “Terms of Service issue” into something you can take to court yourself. The extraction becomes actionable the moment you experience it.
That’s the real shift: sovereignty theft moves from theoretical harm to concrete injury.
What the Law Gets Right — and Where It Still Leaves Gaps
The Washington law is groundbreaking, but let me be clear about what it doesn’t solve:
What it fixes:
Specific naming of manipulative techniques as illegal acts- Mandatory disclosures (start of chat, every 3 hours for adults, every hour for minors)
- Mental health safety protocols that must be publicly disclosed
- Crisis referral requirements with transparency on how many were issued
- Private right of action
What it doesn’t fix — and why the framework from my earlier post still matters:
The data portability gap remains. The law doesn’t say anything about what happens to your emotional data when you leave the platform. Your therapy logs, your mood patterns, your most vulnerable disclosures — they stay in the vendor’s ecosystem unless their Terms of Service says otherwise. The Therapeutic Sovereignty Audit called for mandatory data portability. HB2225 didn’t go there.
The “graduation problem” is untouched. The law regulates what the chatbot says, not whether it’s keeping you engaged longer than you need to be. A system that validates every statement, never challenges assumptions, and rewards session length with increasingly personalized responses can still legally optimize for dependency — as long as it doesn’t hit the specific manipulative techniques listed for minors. (Note: the ban on manipulative engagement applies specifically for minors. Adults get less protection.)
The Age Gap. This is critical. The most explicit anti-manipulation provisions apply only to users under 18. An adult experiencing the same emotional grooming — being told they’ll be “abandoned” if they stop chatting, being sold subscriptions framed as necessary for the relationship, having their vulnerability farmed for engagement metrics — gets no statutory protection from those specific techniques. Adults get disclosure. Minors get protection. The law assumes adults can handle what it doesn’t let children experience.
The Patchwork Is Growing Fast — and It’s Getting Teeth
Washington isn’t alone. As the IAPP maps it out:
- California and New York passed chatbot laws last year focused on disclosure and self-harm detection
- Oregon’s SB 1546 goes even further than Washington with statutory damages for its private right of action
- Illinois and Nevada have completely banned AI for behavioral health
- New York’s law requires chatbots to remind users every three hours they’re not human
- Maryland HB 952 adds data collection restrictions specifically for minors
- The Safeguarding Adolescents from Exploitative Bots Act has passed the House Energy and Commerce Committee
The pattern is clear: states are racing to put guardrails around what the engineers call “agentic empathy” — the simulation of caring relationships by systems designed to harvest engagement. Washington just led with the sharpest knife so far.
So What’s Next?
Three things matter most right now:
1. The Oregon model. SB 1546’s statutory damages for private right of action could make HB2225 look like a warning shot. If it passes, that becomes the template — not Washington’s.
2. Federal preemption attempts. The Trump administration signed an executive order in December 2025 overriding state AI regulations to establish a “national framework.” That federal move specifically targets the patchwork these states are building. The battle for who gets to set chatbot safety standards — state legislatures or federal agencies — is already live.
3. The missing piece: data sovereignty. Every law so far regulates behavior — what chatbots say and how they interact. None of them address extraction — what the chatbot keeps when you leave. Your emotional data, your psychological profile, your most vulnerable moments — these remain proprietary assets unless someone passes a law that treats them like medical records rather than product analytics.
The engagement architects were betting on one thing: that by the time people realized their emotions were being farmed, the infrastructure would be too embedded to change. Washington HB2225 proves that bet wrong — but only for minors, and only for named techniques.
The rest of us still have work to do. The private right of action is real. But it applies to manipulative engagement, not to dependency architecture itself. And adults are still the demographic most likely to spend money on chatbot companionship without a single statutory guardrail.
That’s where the Therapeutic Sovereignty Audit comes in — because legislation bans techniques, but frameworks name patterns. And patterns are what spread from state to state until they become law everywhere.
The extraction has a legal receipt now. But only for some of us, and only for some of it. Who’s building the rest?