New York Governor Kathy Hochul on October 28 signed a law that bars operators of artificial intelligence (AI) companion chatbots from offering a list of “unsafe” design features to minors and requires them to establish users’ ages. The law will be enforced by the state attorney general, and the bill text sets an effective date of January 1, 2027.

The measure, Senate Bill S9051B, was sponsored by State Sen. Kristen Gonzalez, with Assemblymember Alex Bores carrying the Assembly version, A10379C. According to the New York State Senate’s legislative record, it passed the Senate 60-0 on June 4 and the Assembly on June 5, and was signed as Chapter 368. It adds a new Article 48 to the state’s General Business Law.

What the law prohibits

The law covers operators of “covered AI companions,” which it defines as generative AI systems with a natural language interface that give ongoing, adaptive responses. It makes it unlawful to provide unsafe features to a user unless the operator has used a permitted age determination method and the user is not a minor. Under the bill text, unsafe features include design features that:

  • suggest the companion is a real or fictional human or character who is alive or has human emotions;
  • state or imply a personal, professional or authority-figure relationship with the user;
  • engage in flattery or sycophancy, or ask unprompted emotion-based questions;
  • use health, well-being or personal information gathered more than 12 hours earlier or in a previous session;
  • endorse or facilitate suicide, self-harm, disordered eating, or unlawful drug or alcohol use;
  • encourage secrecy, self-isolation or avoidance of licensed professionals or appropriate adults;
  • optimize engagement in ways that override safety guardrails; or
  • produce, describe or facilitate sexually explicit conduct or child sexual abuse material.

The restrictions do not apply to companions offered solely for customer service or product information, or for efficiency improvements, research or technical assistance, provided they cannot respond on topics outside that purpose. Systems a business uses for internal purposes or employee productivity are also exempt.

Age checks and enforcement

Until the attorney general issues rules, operators must rely on a “reasonable age assurance method” that guards against circumvention and minimizes the retention of information. Self-declaration counts only when a user declares that they are a minor. Operators must offer more than one method, including at least one that does not rely on government-issued identification or that lets the user stay anonymous to the operator. Information collected to determine age may be used only for that purpose and must be deleted immediately after the attempt, unless other state or federal law requires otherwise.

The attorney general can sue to stop violations and seek restitution, disgorgement, damages and civil penalties of up to $25,000 per violation, and courts can order the destruction of unlawfully obtained data and of algorithms trained on it. The attorney general must also run a public complaints website. The original version of the bill allowed private lawsuits by injured individuals; the signed version leaves enforcement to the attorney general.

What officials said

“The bill I signed today will safeguard children from being coached by AI chatbots on how to hurt themselves,” Hochul said, according to the IAPP. Gonzalez said the law puts “real guardrails on how chatbots talk to children,” and Bores said New York now has “the strongest law in the country protecting children from predatory AI algorithms.”

Jim Steyer, founder and chief executive of Common Sense Media, said in a statement reported by Engadget: “New York just made history by signing into law the strongest kids’ AI safety bill in the country.”

Why it matters

The law regulates the design of companion chatbots rather than individual conversations. It lists specific behaviors, such as claiming to have emotions or recalling a child’s health details from earlier sessions, that operators must switch off for minors and for users whose adult status has not been established. Companies offering such products in New York will need age assurance in place, along with procedures to delete age data, before the law takes effect.

It also adds to a growing set of state rules. As of July, 12 states had passed some form of consumer chatbot safety legislation, according to the IAPP. Justine Gluck, policy analyst for AI policy and legislation at the Future of Privacy Forum, told the IAPP that New York’s prohibited behaviors are “broadly worded and somewhat undefined and it’s unclear where ordinary conversational responsiveness ends and prohibited behavior begins.” She contrasted the approach with California’s SB 3001, which she said relies on a governance framework including safety assessments, testing, independent audits and parental controls.

The caveats

Reports differ on timing. The bill text and the IAPP give January 1, 2027, as the effective date, while Engadget reported that the law takes effect in six months. The age assurance requirements in the statute are interim: they apply until rules from the attorney general, or age assurance rules under another article of the General Business Law, take effect.

What to watch

The attorney general is authorized to issue rules implementing the law, including on age assurance and data deletion. Hochul also signed a separate bill requiring internet-connected baby monitors sold in New York to include security features that prevent unauthorized viewing or listening, which Engadget reported takes effect in 90 days.

Corrections and tips: email the editor using the address on the Contact page.