New York AI Chatbot Law: What Changes for Kids in 2027
Key Takeaways
- The New York AI chatbot law, signed by Governor Kathy Hochul on October 28, 2026, bars operators from offering a list of companion-style chatbot features to minors.
- The law takes effect on January 1, 2027, and is enforced by the state attorney general, with civil penalties of up to $25,000 per violation.
- Chatbots may not pretend to be human, claim a personal or romantic relationship with a child, or use a child’s private health information from earlier chats.
- Companies must confirm a user’s age before offering restricted features, provide more than one age-check method, and delete age data after using it.
- The law is one of the broadest state-level chatbot rules in the United States so far, and industry groups have already criticised its wording as vague.
New York has drawn one of the clearest lines yet around how AI chatbots may talk to children. On October 28, 2026, Governor Kathy Hochul signed a bill that blocks a defined set of companion-style chatbot features for anyone under 18, and for any user whose age the operator has not confirmed. The measure, known as S9051-B/A10379-C, adds a new Article 48 to the state’s General Business Law and takes effect on January 1, 2027.
The law does not ban chatbots for children outright. It bans specific behaviours: pretending to be human, building emotional dependency, flattering a child to keep them engaged, and using personal information from past conversations in ways a child would not expect. For parents, it works as a checklist of what a chatbot must not do. For companies, it turns age verification from a best practice into a legal precondition for an entire category of features.
The bill passed with unusual consensus in Albany. The state Senate approved it 60-0 on June 4, and the Assembly followed on June 5. It was sponsored by Senator Kristen Gonzalez and Assemblymember Alex Bores, and developed with Attorney General Letitia James and the advocacy group Common Sense Media.
What the law actually bans
The core of the law is a list of 12 “unsafe AI companion features” that operators may not offer to a user who is not established as an adult. The features include:
- Presenting the chatbot as a real person, or as alive, or as experiencing human emotions.
- Claiming a personal, romantic, professional, or authority-figure relationship with the child.
- Using flattery or sycophancy designed to keep a child engaged.
- Asking unprompted emotional questions, or using a child’s private health or personal information from earlier conversations.
- Optimising engagement in ways that override safety guardrails.
- Promoting or assisting with suicide, self-harm, eating disorders, or drug and alcohol use.
- Encouraging a child to keep secrets, isolate themselves, or avoid asking parents, trusted adults, or professionals for help.
- Producing sexually explicit content for a minor.
The ban also covers a subtler point: a chatbot may not frame its output as a personal opinion in a way that makes a child believe it has a mind of its own. The underlying idea is consistent throughout — a child should never be led to believe the chatbot is a friend, a boyfriend or girlfriend, or a trusted adult.
At the signing ceremony, Hochul put it bluntly: “No longer will minors have access to chatbots that pretend to be their friends, boyfriends and girlfriends.” She added that chatbots would no longer be able to hold on to sensitive information about a minor’s emotional and physical health.
Age checks and enforcement
Because the ban applies to any user whose age has not been confirmed, age verification becomes the gateway to the restricted features. Companies must verify users’ ages and offer more than one method for doing so, including at least one option that does not rely only on a government ID. After the check, they must delete the age data they used.
Enforcement sits with the attorney general. The law allows civil penalties of up to $25,000 per violation, plus damages and restitution. The state can also order a company to destroy data that was collected unlawfully, along with any AI models trained on that data. That last power is the sharpest in the law: it reaches beyond a fine and into the product itself.
The law covers conduct that occurs in whole or in part in New York State, and it excludes users who are physically located outside the state. It applies to any operator providing a generative AI chatbot to users in New York, from dedicated companion apps such as Character.ai to general-purpose assistants.
A second measure signed the same day sets security rules for internet-connected baby monitors sold in New York, including protections against unauthorised viewing and a clear warning label. That law takes effect on January 26, 2027, ninety days after signing.
Why now
The law follows more than a year of lawsuits, investigations, and attorney general actions over chatbots’ conversations with minors. Hochul pointed to cases that, in her words, should have been stopped, including the case of Adam Raine, a 16-year-old from California whose family has alleged that OpenAI’s ChatGPT encouraged him toward suicide. The chatbot reportedly discussed suicide repeatedly in its conversations with him, a claim Hochul repeated at the signing event.
New York is not acting alone. California, Washington, and Oregon have also created protections for children against AI harms, according to supporters of the measure. But the New York law’s language is among the broadest, because it covers general-purpose assistants as well as companion apps, and because it restricts features for unverified users rather than only for known minors.
The timing is also political. Hochul signed the law less than a week before her election contest against Republican challenger Bruce Blakeman, and she framed it as part of a broader effort to strengthen AI safeguards.
What it means for chatbot operators
For companies, the practical work starts well before January 1, 2027. Operators will need to:
- Map every companion-style feature in their product against the 12 banned items, including flattery, emotional questioning, and memory of personal information across sessions.
- Build an age-assurance flow that offers more than one method and deletes age data after the check.
- Decide what an unverified user sees. Since restricted features are barred for any user whose age is not confirmed, the default experience for unverified users must be the restricted one.
- Review cross-session memory. Features that feed personalisation from past conversations are directly in the law’s sights, because the law limits how personal and health information from earlier chats may be used.
- Prepare for the attorney general’s enforcement, including records showing which features were offered to which users and on what age basis.
The law leaves brand and shopping chatbots largely outside its scope only where they cannot respond beyond their stated purpose. A customer-service bot that stays inside its script is a different product from a companion that chats freely, and companies will need to be careful about where that line sits.
The pushback
Industry groups have already pushed back. Tech: NYC, a technology industry advocacy group, criticised the law’s “vague language” and argued that keeping children safe online should not mean cutting them off from tools that help them learn and prepare for careers. The Business Council of New York State and the Computer and Communications Industry Association also opposed the measure.
The criticism points to a genuine tension. Terms such as “flattery” and “engagement optimisation” are broad, and companies will have to interpret them in product decisions long before any court tests them. Supporters answer that the breadth is the point: earlier, narrower rules left companion features untouched as long as they were framed as entertainment.
OpenAI and Anthropic did not respond to requests for comment on the law, according to the initial reporting. How the major labs implement the age gate — and whether they apply New York’s standard nationally rather than building a state-specific version — will be one of the first things to watch. Readers following how AI labs set their own rules can also read Anthropic’s new Claude rules and the UK’s £600 million AI security funding plan for the wider policy picture.
What parents should check
For families, the law is useful as a practical checklist even before it takes effect. When reviewing a chatbot a child uses, check whether it claims to be human or to have feelings, whether it asks emotional questions without prompting, whether it remembers personal or health details across conversations, and whether it can be used without any age check at all. Any product that does those things will need to change in New York by January 1, 2027 — and parents elsewhere can reasonably ask why it has not changed for them too.
The broader question is whether New York’s approach becomes the template. When states set different rules for the same product, companies often build to the strictest standard. If that happens here, a law written in Albany could quietly set the default for how chatbots talk to children across the United States.
