Chatbot Safety Starts with the Product's Boundaries
Colorado's chatbot-safety framework asks a different question from the ADMT rules. Instead of starting with a consequential decision, it starts with the conversational service itself: is it a bounded tool, or does its design and ongoing interaction resemble an open-ended companion? The supplied rulemaking document turns that question into a set of operational controls—age assurance, visible disclosure, minor-safety safeguards, crisis protocols, testing, and reporting. Those controls let readers judge a service by what it does and how it changes over time, rather than by the label attached to it.
A bounded task is not the same as a companion
The rulemaking document treats a service that answers a billing question, reports an order status, or schedules an appointment as a possible example of a “narrow and discrete topic.” The task is bounded: the service has a defined job, and its output is tied to completing that job. Menu-based and rule-based chatbots may fit the same idea when they cannot move into prohibited sexual content or dialogue about suicidal ideation or self-harm.
The boundary becomes less certain when a product's stated purpose is narrow but its behavior is broad. A tutoring service may adapt to a student, remember prior sessions, and respond to topics outside the lesson. A workplace assistant may begin as a technical tool but sustain personal or emotionally sensitive conversation. A wellness service may be marketed for a limited purpose while inviting open-ended, personalized interaction. The Future of Privacy Forum's comment letter identifies these kinds of cases as reasons for illustrative examples rather than a definition that depends on a product's marketing sentence.
The proposed text also uses a totality-of-the-circumstances approach for several exemptions. For a business-oriented service, relevant facts include whether its interface is generally available to consumers, whether it is marketed primarily to business entities, and whether its design is structured around business operations, productivity, analysis, internal research, training, or technical assistance. For a game-related service, the question is whether dialogue stays tied to gameplay, story, or functionality and whether the conversational service is only one component rather than the game's primary or only component.
Emotional companionship and emotional dependence require a closer look at design. A chatbot that can be given a name, gender, avatar, or fictional backstory is more anthropomorphic than a form that answers a transaction question. Personalized dialogue, memory of a user's characteristics and past conversations, sycophantic validation, and responses that simulate empathy can make the relationship feel more personal. Features that increase emotional intensity across sessions, create reinforcement loops, or encourage a user to return for reassurance can push further toward emotionally dependent interaction.
These are indicators, not an exhaustive classification. A name or avatar alone does not establish the entire legal result, and a narrow label does not settle the question if the service can wander into the risks the statute addresses. The important shift is analytical: product purpose, interface, memory, marketing, model behavior, and safety measures must be considered together.
Age assurance is a continuing process
If a service must protect minors, the proposed rules treat age assurance as a continuing risk-management problem, not as a single mandatory technology. A commercially reasonable or generally accepted method should collect only what is necessary for age assurance, avoid secondary uses, offer users meaningful choice, and not rely as its sole method on government-issued identification.