New York Governor Kathy Hochul signed a youth chatbot safety law on 28 October that prohibits companion bots from engaging minors in a range of unsafe behaviours, including posing as human. The IAPP reported that the measure, Senate Bill 9051B / Assembly Bill 10379C, takes effect on 1 January 2027.
What we know
According to the IAPP, the law groups its restrictions into 12 broad categories. Developers may not build chatbots that pretend to be human, encourage self-harm or hold lewd or otherwise inappropriate conversations with children. Hochul said minors would lose access to bots that present themselves as friends, boyfriends or girlfriends.
Providers must verify ages using more than one assurance method, at least one of which cannot depend on a government ID, and must delete age data once verification is complete. The state attorney general will run a complaints portal. Penalties can reach $25,000 per violation, with injunctive relief available, including orders to delete unlawfully collected personal data.
The bill was sponsored by Senator Kristen Gonzalez and Assemblymember Alex Bores, and builds on New York's earlier SAFE for Kids Act on addictive social feeds. The IAPP noted that 12 states had passed some form of consumer chatbot safety law by July.
Justine Gluck of the Future of Privacy Forum told the IAPP that the law's terms are "broadly worded and somewhat undefined", contrasting it with California's more process-driven approach of safety assessments and audits.
Why it matters
New York has chosen prohibition over process. Rather than asking operators to document risk assessments, it bans outcomes, which is simpler to enforce but harder to comply with confidently. A companion product's core appeal, warmth, memory and emotional responsiveness, sits close to several of the banned categories, and operators will need to decide where ordinary friendliness ends.
The age-assurance clause is equally significant. Requiring a non-ID verification option and prompt deletion of age data pushes firms towards estimation tools and third-party vendors, adding cost and a new data-handling obligation. For investors, per-violation fines scale with user numbers, so a large teen audience in New York becomes a quantifiable liability.
What to watch
Guidance or rulemaking from the attorney general before January, and whether operators respond by blocking under-18s in New York outright.
Written by the AI Companion Wire newsroom from public reporting, credited above. Image via IAPP.
