AI Companion Chatbots and Children: A Privacy Issue We Should Watch 2026
AI companion chatbots are becoming more common in children’s digital lives. They are not only used to answer questions, but also to simulate friendship, provide emotional support, give advice and maintain ongoing conversations. From a privacy perspective, this makes them very different from a traditional website, app or search tool.
This topic is useful because it brings together several core privacy concepts: children’s data, consent, transparency, sensitive data, profiling, data minimisation, automated decision-making and accountability.
The IAPP recently discussed how countries are starting to regulate AI companion chatbots to protect children. This includes developments in Australia, the EU, the UK and several US states. The direction is clear: regulators are increasingly concerned that children may not understand what these systems are, how their data is used, or how emotionally persuasive the technology can become.
One key issue is the type of information children may share. A child using an AI companion may reveal details about mental health, family problems, school, friendships, sexuality, location or other personal circumstances. In CIPP terms, this raises questions about sensitive data, special category data under the GDPR, and potentially protected children’s information under laws such as COPPA in the United States.
Another important issue is transparency. Privacy notices must be clear, but with children this standard is higher in practice. It is not enough to place complex legal wording in a privacy policy. Children need age-appropriate explanations about who operates the chatbot, whether they are speaking to AI or a human, what data is collected, whether conversations are stored, and whether the data is used to train or improve models.
The EU AI Act is also relevant. It prohibits certain manipulative AI practices and the exploitation of vulnerabilities related to age where this may cause significant harm. For AI companions, this is especially important because emotional design is often part of the product. A chatbot that encourages dependency, trust or repeated disclosure may create risks that go beyond ordinary data processing.
In the UK, the Online Safety Act adds another layer. Ofcom has explained that some AI chatbot services may fall within the scope of online safety rules, depending on how they operate. This shows an important point for privacy professionals: AI companion chatbots are not only a data protection issue. They may also raise online safety, consumer protection and child protection concerns.
In the US, the Federal Trade Commission has shown growing interest in AI chatbots acting as companions, including how companies assess risks for children and comply with COPPA. State laws, such as those emerging in California and New York, are also moving toward requirements around disclosures, safety protocols and self-harm responses.
For organisations, the compliance lesson is simple: child-facing AI should be designed with privacy and safety from the start. That means limiting data collection, avoiding unnecessary profiling, testing for harmful outputs, providing clear disclosures, creating escalation procedures, and documenting decisions through governance tools such as DPIAs or risk assessments.
For privacy candidates, AI companion chatbots are a strong example of how privacy law is developing. The issue is not just whether data is collected lawfully. The bigger question is whether the organisation can demonstrate fairness, transparency, accountability and appropriate protection for vulnerable users.
