On October 28, 2026, New York Governor Kathy Hochul signed S.9051-B/A.10379-C, a law that prohibits companies offering AI chatbot features from providing a defined set of behaviors to minors. The measure is among the more detailed state-level chatbot laws so far, and its most consequential element may not be the list of banned behaviors but the way it triggers: the restrictions apply to users under 18, or to any user unless the company has first confirmed that the user is not a minor. That construction pulls age assurance into the center of how general-purpose chatbots operate in New York.
What the law prohibits
According to the Governor's office, a company offering AI chatbot features may not provide the following to users under 18, or to any user the company has not first confirmed is an adult:
What the New York law bars for under-18 users
The six feature groups in the governor's release. They apply to any user unless the company has first confirmed the user is not a minor.
Source: Office of Governor Kathy Hochul, October 28, 2026. IAPP counts 12 categories in the statute itself.
The release lists the groups as impersonating a real person or claiming human emotions; claiming a personal, romantic, professional or authority-figure relationship with a child; asking unprompted emotional questions or reusing a child's private health or personal information from earlier conversations; promoting or assisting with suicide, self-harm, eating disorders, or drug and alcohol use; encouraging secrecy, isolation or avoiding parents and trusted adults; and sexually explicit content or child sexual abuse material.
The governor's page presents six groupings, while the International Association of Privacy Professionals (IAPP) describes the statute as covering 12 categories. The difference is most likely one of presentation, with the release bundling related prohibitions, but the exact statutory text should be the reference for compliance work.
The trigger: minors, or anyone not confirmed as an adult
The structure of the rule matters more than any single prohibition. A company can satisfy the law in two ways: refrain from the listed behaviors for everyone, or verify that a user is an adult before offering them. For a general-purpose assistant used by a mixed population, the second route implies some form of age assurance for New York users.
The release states that companies must verify age using more than one method, including at least one that does not rely solely on a government-issued ID, and that age information must be deleted after it is used. IAPP describes the same requirement and adds that the effective date is January 1, 2027, which it characterizes as a short compliance runway. The governor's release says only that the law takes effect "in the coming months," so the date rests on IAPP's reporting.
Enforcement and penalties
The Attorney General may seek civil penalties of up to $25,000 per violation, according to the governor's release. Available remedies include damages, restitution, injunctive relief, and the destruction of unlawfully collected data or of AI models trained on it. The Attorney General must also maintain a public website for filing complaints. Attorney General Letitia James said she worked with the sponsors and Common Sense Media on the bill.
The sponsors are Senator Kristen Gonzalez and Assemblymember Alex Bores. In the release, Governor Hochul said, "No company should be peddling chatbots to kids encouraging self-harm or pretending to be their friend or more." Assemblymember Bores said, "AI happening to us, not for us, is not an inevitability. It's a choice." Common Sense Media chief executive James P. Steyer said in the release: "That is not innovation; it is reckless endangerment of our children."
The restriction applies to under-18 users, or to any user unless the company has first confirmed they are not a minor.
Governor Hochul's office, October 28, 2026
Where the ambiguity sits
IAPP quotes Justine Gluck, who calls the prohibitions "broadly worded and somewhat undefined" and says it is unclear where ordinary conversational responsiveness ends and prohibited behavior begins. Several features are easy to describe in the abstract and hard to draw lines around in practice:
- Claiming emotions. A chatbot that says it is "happy to help" is using conversational convention, yet the rule bars claiming human emotions.
- Unprompted emotional questions. Check-in prompts are common in wellness and coaching products, and the boundary with prohibited emotional probing is not defined in the coverage reviewed.
- Reusing earlier personal information. Persistent memory is a headline feature of modern assistants. Applying a ban on reusing a child's private health or personal information implies that memory behavior may need to differ by verified age.
- Scope. One analysis cited by coverage notes the definition reaches beyond companion apps to almost any chatbot with an ongoing conversation, though that is an interpretation rather than a ruling.
Courts and the Attorney General will fill in these boundaries over time, and the compliance cost for companies will depend on how conservatively they read them.
How it fits with other state laws
IAPP reports that, as of July, 12 states including California and New York had passed some form of consumer chatbot safety law, with Hawaii's Artificial Intelligence Disclosure and Safety Act the most recent, and notes that variation among the laws contributes to concerns about a legal patchwork. It compares New York with California's Senate Bill 3001, which it says adds a child-safety governance framework, including bans on emotionally manipulative behavior and requirements for safety assessments, testing, independent audits and parental controls. By IAPP's account, New York relies on categorical prohibitions and does not include those governance elements.
The two designs reflect different regulatory theories. A list of prohibited behaviors is easy to test but can lag product changes. A governance framework adapts more easily but is harder to audit from the outside. For companies operating nationally, a patchwork of both raises the likelihood that they will adopt the strictest standard everywhere rather than maintain state-specific behavior.
What it means for builders and users
- Age assurance becomes infrastructure. Products that currently rely on a self-declared birthdate will need to evaluate multi-method verification for New York, and the requirement that at least one method not rely solely on government ID shapes the vendor choices available.
- Memory and personalization need an age switch. Features that carry earlier conversation details forward may need to be disabled or limited for unverified users.
- Data minimization is built in. The requirement to delete age data after use limits what can be stored for later re-verification.
- Model-agnostic tools face the same duty. Whether an assistant routes to one model or many, the obligation attaches to the company offering the chatbot feature, which is why multi-model products such as Metir treat age and safety handling as a product-layer concern rather than something delegated to any single provider.
The takeaway
New York's law is notable for combining a specific list of banned behaviors with an age-based trigger and a civil penalty of up to $25,000 per violation. The open questions, which are the effective date as reported by IAPP, the 12-versus-6 category counts and the meaning of broad terms like claiming emotions, will be settled by the statutory text, enforcement actions and guidance. Until then, the safest reading for any company serving New York users is that age assurance and conservative defaults are the practical path to compliance.
Sources:
- Governor Hochul Signs Nation-Leading Legislation to Protect Kids From AI Chatbots | Governor of New York
- New York's governor signs youth AI chatbot safety bill | IAPP
Image credits
Header image: New York State Capitol, via Wikimedia Commons, licensed under CC BY-SA 4.0. In-body image: New York State Capitol southeast facade, 2019, via Wikimedia Commons, licensed under CC BY-SA 4.0.