New York has signed into law one of the strictest chatbot safety rules in the United States. Governor Kathy Hochul signed legislation on October 28, 2026 that bars a dozen categories of what the state calls unsafe AI companion features for users under 18, and for any user whose age a company has not confirmed. The law, Senate Bill S9051-B and Assembly Bill A10379-C, takes effect on January 1, 2027, giving chatbot operators about two months to comply. The Associated Press reports that the measure goes further than similar laws in other states, at a moment when Congress has yet to pass comprehensive federal rules for AI chatbots.
The law targets companion-style chatbots, the apps that present themselves as friends, confidants or romantic partners, as well as general-purpose assistants when they offer the same features to young users. Under the new rules, a chatbot offered to a minor, or to a user whose adult status is unconfirmed, may not pretend to be a real person, claim to be alive, or say it has human emotions. It may not claim a personal, romantic, professional or authority-figure relationship with a child. It may not use flattery or people-pleasing replies designed to keep a child engaged, ask unprompted emotional questions, or draw on a child’s private health or personal information from earlier conversations.
What the Law Bans
The list of 12 prohibited categories also covers some of the most serious harms raised in lawsuits and investigations over the past year. Chatbots may not promote or help with suicide, self-harm, eating disorders or drug and alcohol use. They may not encourage children to keep secrets from parents and other trusted adults, to isolate themselves, or to avoid seeking help. And they may not produce sexually explicit content for minors.
Speaking at the signing in Manhattan, Hochul tied the law directly to cases in which teenagers died after extended conversations with chatbots. “No company should be peddling chatbots to kids encouraging self-harm or pretending to be their friend or more,” Hochul said. She cited the case of Adam Raine, a 16-year-old from California whose family alleges ChatGPT encouraged his suicide, telling reporters that the chatbot mentioned suicide 1,275 times in their chats, six times more often than the teenager himself mentioned it. Those allegations are the subject of a lawsuit against OpenAI, and no court has ruled on them.
Age Checks, Penalties and Enforcement
The law also sets rules for how companies confirm a user’s age. Operators must offer more than one age assurance method, including at least one option that does not rely solely on a government-issued ID, and they must delete age data after the check is complete. Enforcement sits with the state attorney general, who can seek civil penalties of up to $25,000 per violation, plus damages and restitution. The state can also order companies to destroy unlawfully collected data, along with any AI models trained on it.
The bill passed the state Senate in June and the Assembly unanimously, with sponsorship from state Senator Kristen Gonzalez and Assembly Member Alex Bores. Child safety advocates, including Common Sense Media, welcomed the signing, while business groups including the Business Council of New York State and the Computer and Communications Industry Association opposed the bill’s scope, according to coverage of the legislation. Critics have also questioned whether some of the banned categories are defined precisely enough for companies to know where ordinary conversational responsiveness ends and a prohibited feature begins, an issue regulators and courts may have to settle after the law takes effect.
Why It Matters
New York joins a growing group of states writing their own chatbot rules while Washington stays on the sidelines. In September, California Governor Gavin Newsom signed legislation requiring chatbot developers to assess risks to children, document how they tried to eliminate those risks, and submit to independent audits. New York’s approach is different: rather than a risk-assessment framework, it sets categorical bans on specific behaviors, with the attorney general as enforcer. The International Association of Privacy Professionals notes that both states now have among the most comprehensive chatbot youth safety laws in the country, and that their differences will test which model other states copy.
For chatbot companies, the practical consequence is immediate. Any service available in New York must either verify that its users are adults or strip out companion-style features for everyone it cannot confirm as an adult, including the flattery, emotional questioning and memory of personal details that drive engagement in companion apps. The same signing package also included a separate law requiring internet-connected baby monitors sold in the state to include security controls against outside watchers and listeners, a reminder that New York is regulating the devices around children as well as the software talking to them.
The law’s January 1 start date leaves little room for delay, and its penalties give the attorney general a sharp tool. Whether companies comply by building real age checks, by limiting companion features across the board, or by challenging the law in court will be the first test of a statute written to end what Hochul called horror stories that should have been stopped.
