Rules That Limit AI: Idaho's Chatbot Law, the States and the Preemption Fight

The lesson AI Law and Regulation covers the EU AI Act and its 2026 delays, Colorado's rewritten AI Act, California's frontier model law SB 53, and Idaho's election deepfake statute. This lesson adds Idaho's newest AI law, places the rules in layers, and brings the federal preemption fight up to October 2026.

Idaho's Conversational AI Safety Act

Senate Bill 1297 came out of the Senate State Affairs Committee in February 2026, with Sen. Toews and Rep. Crane as floor sponsors. It passed the Senate 21 to 12 and the House 54 to 12, and Gov. Brad Little signed it March 31, 2026. It becomes Chapter 21 of Title 48, Idaho Code, and takes effect July 1, 2027.

Who it covers

An "operator" is anyone who makes a "conversational AI service" available to the public: a publicly accessible AI program that primarily simulates human conversation by text, image or voice. The exclusions are long and matter more than the definition. Not covered:

• developer and research tools;
• a feature inside some other app that is not itself a conversational service;
• video game chatbots that stick to the game and stay off mental health, self-harm and material harmful to minors;
• narrow single-topic tools;
• business and enterprise products, internal tools, and bots for customer service, operations or productivity;
• voice assistants on consumer devices.

App stores and search engines are not operators just because they link to a chatbot. And the act does not hold a model developer liable when a third party builds a public chatbot on its model.

What every operator must do

• If a reasonable person would be misled into thinking they are talking to a human, clearly disclose that it is AI.
• Adopt a protocol for prompts about suicidal ideation that includes reasonable efforts to refer users to crisis services such as a suicide hotline or crisis text line.
• Not knowingly and intentionally program the service to claim it is designed to provide professional mental or behavioral health care.

Extra duties for minors

A "minor" is someone the operator knows, or is reasonably certain, is under 18. For minor account holders, the operator must:

• disclose that it is AI, either with a persistent notice or at the start of each session and at least every three hours;
• not hand out points or rewards at unpredictable intervals meant to drive more use;
• take reasonable measures to block sexually explicit images, statements urging sexual conduct, and sexually objectifying statements;
• take reasonable measures to stop the bot from claiming to be human or sentient, simulating emotional dependence, making romantic or sexual innuendo, or role-playing adult-minor romance;
• offer privacy and account tools to users, to parents of users under 13, and related tools to parents of teens as appropriate to the risks.

Note what the act does not require: age verification. The minor duties turn on what the operator knows or is reasonably certain of. Idaho's separate 2026 social media law, HB 542, does require platforms to estimate users' ages and get parental consent for users under 16, according to a Stateside session summary.

The layers of AI rules

Layer	Example	Reaches	Status, October 2026
EU law	AI Act	Anyone selling AI into the EU	Bans and general model duties in force; high-risk duties delayed to Dec 2027 and Aug 2028
Federal statute	None broad; existing consumer, civil rights and telecom laws apply	Everyone	Preemption bill in draft only
Federal executive	EO 14319 procurement terms; EO 14365 litigation and funding pressure	Federal agencies and vendors; states through grants	In effect; several EO 14365 deadlines missed
State, broad	Colorado SB 26-189; California SB 53	Deployers in consequential decisions; frontier developers	Colorado starts Jan 1, 2027; SB 53 in force since Jan 1, 2026
State, narrow	Idaho S1297 chatbots; Idaho Code 67-6628A election deepfakes	Public chatbots; election ads	S1297 starts Jul 1, 2027; 67-6628A in force
Local	Zoning and conditions on data centers	Buildings, not AI models	Unaffected by AI preemption proposals so far

The preemption fight, brought up to date

Executive pressure. EO 14365 (December 11, 2025) told the Justice Department to sue states, Commerce to list "onerous" state laws, and the FTC and FCC to develop preemption theories, and it tied some broadband money to state AI policy. The Attorney General set up the AI Litigation Task Force on January 9, 2026. As of an April 2026 review, the Commerce evaluation, the broadband notice and the FTC statement, all due March 11, had not been published. The FTC proposed a policy statement in early July 2026 (Federal Register, July 7; comments closed July 31) suggesting that even Colorado's narrowed AI law may be preempted; no final statement had been published by mid-October. In April 2026 the Justice Department intervened in xAI's federal lawsuit against Colorado's original AI Act, and enforcement was stayed, not on the merits, according to an Arnold and Porter review. CASRAI's September tracker reports no lawsuit filed by the task force itself.

A White House legislative ask. On March 20, 2026 the White House released a National Policy Framework for Artificial Intelligence, recommending that Congress preempt state AI laws that impose "undue burdens" with a minimally burdensome national standard. According to Ropes and Gray's summary, states would be barred from regulating AI development or penalizing developers for others' unlawful use, and from regulating AI use for activity that would be lawful without AI. Left to the states: generally applicable laws such as zoning and consumer protection, state government AI use and purchasing, child protection including AI-generated child sexual abuse material, and fraud enforcement. The framework also proposes federal child safety measures: parental tools, privacy-protective age checks on AI platforms used by minors, and features to reduce exploitation and self-harm risks. That overlaps heavily with what Idaho's act already requires.

Congress. The Senate removed a 10-year moratorium on state AI enforcement from the 2025 reconciliation bill by 99 to 1. The Great American AI Act, a June 2026 bipartisan discussion draft, would preempt state laws on AI model development for three years and leave deployment and use laws alone. It had not been filed by late September. In mid-September 2026, Speaker Mike Johnson said Congress should not "panic" into emergency AI regulation, which CASRAI read as lowering the odds of a preemption statute passing soon.

The arguments, both ways

For preemption: AI is sold nationwide, 50 different rulebooks raise costs and favor large companies that can afford compliance, and some state rules may compel speech or alter truthful outputs. The administration and groups like Leading the Future make this case.

Against: Congress has not passed national rules, so preemption without a federal standard leaves a vacuum; states are where consumer protection has always started; and child safety, fraud and civil rights problems are happening now. More than 200 state lawmakers and several labor groups pushed this side in a July 2026 letter, and Public First, funded by Anthropic, backs stronger oversight in general.

The ground both sides share is larger than the fight suggests. Even the White House framework would leave child safety, fraud and state procurement to states, which covers most of what Idaho has passed.