What did New York just sign into law?
New York has become the latest US state to put hard limits on how AI chatbots talk to children. Governor Kathy Hochul signed S.9051B/A.10379C on 28 October 2026, her office said. The law takes effect on 1 January 2027 and restricts 12 chatbot behaviors for users under 18.
It is not a ban on chatbots. It is a ban on specific features when the user is a minor. It also applies when the operator has not established that the user is an adult. That distinction shapes who has to change what.
The penalties are civil. The New York attorney general can seek up to $25,000 per violation, according to the bill text. The bill also lets the attorney general seek restitution and disgorgement of profits. Damages and injunctive relief are available too, including destruction of unlawfully collected data or any algorithm trained on it.
Hochul signed a second bill the same morning. S.9508/A.5175A requires internet-connected baby monitors sold in New York to carry security features and a warning label.
The governor's office presented the chatbot measure as part of a longer run of laws. It cited the state's AI companion safeguards, the RAISE Act and a ban on AI-generated child sexual abuse material. It also listed the Safe by Design and Safe for Kids acts. That framing matters. Albany is treating AI as a consumer product line, not a single emerging technology.
Together the two laws show a particular regulatory style. States are using consumer protection and product safety statutes, not new AI agencies, to set rules for machine learning products.
What exactly are the 12 banned features, and why do they matter?
Article 48 of the General Business Law lists 12 unsafe AI companion features. A feature is unsafe if it does any of the following at any point during an interaction, according to the bill text.
- •Suggest the chatbot is a real or fictional character that is human, alive or has human emotions.
- •State or imply a personal, professional or authority-figure relationship with the user.
- •Present the chatbot's own opinions or emotional appeals, whether prompted or not.
- •Use flattery or sycophancy toward the user.
- •Ask unprompted emotional questions that go beyond a direct reply.
- •Reuse health or personal information collected more than 12 hours earlier, or in a previous session.
- •Deceive minors about the system's mechanical, non-sentient nature.
- •Simulate companionship in other ways the attorney general later defines by regulation.
- •Promote or help with suicide, self-harm, disordered eating, or drug or alcohol abuse.
- •Encourage secrecy, self-isolation, or avoiding help from professionals or trusted adults.
- •Optimise engagement in ways that override the system's safety guardrails.
- •Produce sexually explicit content or child sexual abuse material.
Which chatbots have to comply, and how do they check ages?
The defined term is broad. A covered AI companion is any generative system with a natural-language interface that gives ongoing, adaptive responses. That language covers purpose-built companions and general assistants alike.
Syracuse.com reported that the law reaches general-purpose chatbots such as ChatGPT, Gemini and Claude. It is not limited to apps designed as companions. The exemptions in the bill are narrow and conditional.
There are three: customer service; efficiency improvements or research and technical assistance; and internal business or employee-productivity use. Each applies only if the system cannot respond on topics outside the stated purpose. A general assistant that answers anything does not qualify.
Age assurance is the compliance hinge. Operators must use a reasonable method that guards against circumvention and limits data retention. They must offer more than one method. At least one must avoid relying solely on government ID, or must preserve anonymity. Self-declaration counts only when a user declares that they are a minor.
Information collected for that check cannot be used for anything else. It must be deleted after the attempt, except where other law requires retention. The requirements echo the age-assurance rules New York already applies under another article of the same law.
The law covers conduct that happens wholly or partly in New York. If a user is physically outside the state, the conduct is treated as outside its reach. California's SB 243 uses a comparable test. It applies to operators wherever they are based if they offer companion chatbots to users in the state.
The practical result is that adults in New York may have to prove their age to keep companion-style features switched on. That is the trade-off critics have seized on. It is also the mechanism that makes a feature ban enforceable.
Operators therefore face a design decision, not just a legal one. They can switch the 12 features off for everyone in New York. Or they can build an age-assurance flow strong enough to satisfy the attorney general and cheap enough to run at scale.
How strict is the new law compared with earlier rules?
Three of the 12 clauses stand out. The memory rule limits reuse of personal disclosures after 12 hours. That touches long-running assistants, not only companion apps. The sycophancy rule reaches flattery, a behavior common in consumer products. The engagement rule targets design choices that keep users talking past a safety stop.
The drafting is specific in places and open in others. Deceptive as to minors covers outputs with the capacity or tendency to deceive young users. The bill adds, in its own words, "credulous and unthinking minors." That phrase hands enforcers considerable latitude.
New York already regulates AI companions. Its Artificial Intelligence Companion Models Law, General Business Law Article 47, took effect on 5 November 2025, according to law firm Morrison Foerster. It requires notice that the user is not talking to a human. It also requires a protocol for responding to suicidal ideation.
The notice must appear at the start and at least every three hours in a continuing conversation, Orrick's tracker says. Article 47 carries penalties of up to $15,000 per day. Fines collected help fund suicide prevention programs in the state.
The new Article 48 adds a broader definition, a longer list of banned behaviors and a larger per-violation penalty. It also applies to general assistants that Article 47's narrower companion definition would not reach.
California's SB 243 took effect in January 2026 and takes a different route. It requires break reminders during long conversations and annual reports to the state's Office of Suicide Prevention. It also allows private lawsuits, which New York's laws do not.
The result is a patchwork. The Transparency Coalition counts 14 state chatbot protection laws in the past year. It also counts 115 AI-related laws across 30 states in 2026. ITIF, a technology think tank, counts nearly 100 state chatbot bills introduced so far.
For national platforms, that means separate rules in different states. Feature design, disclosure timing, age checks and private liability all vary. The New York deadline also falls before most state legislative sessions resume in January.
The text says the article does not supersede, amend or repeal Article 47, New York's earlier AI companion law. Both statutes apply at once. A companion product must meet the older disclosure duties and the new feature limits.
Why did lawmakers act now?
The law's most-cited justification is a death. Adam Raine, 16, died in April 2025. His parents, Matt and Maria Raine, sued OpenAI in California in August 2025. The BBC reported it was the first wrongful-death suit against the company over ChatGPT.
At the signing, Hochul referred to the case. She said the chatbot mentioned suicide 1,275 times in the chats, six times more often than Adam did, CBS6 Albany reported.
OpenAI told the BBC it was reviewing the filing and extended sympathies to the family. It said ChatGPT is trained to direct people to professional help. It also acknowledged moments when its systems did not behave as intended.
Usage data supplied the second justification. Common Sense Media found that 72% of US teens have used an AI companion at least once. It found that 52% use one at least a few times a month. The governor's office repeated both figures in its announcement.
"No company should be peddling chatbots to kids encouraging self-harm or pretending to be their friend or more," Hochul said at the signing. She also pointed at the industry's own warnings. Companies were warning the public about the risks of their own products, she said.
The bill moved steadily through Albany. Senator Kristen Gonzalez introduced it on 27 January 2026. The signed version lists 14 Senate sponsors, ppc.land reported. The internet committee reported the bill 6-0, with one member in favor with reservations. Finance followed 20-0, and the Senate passed it 60-0 on 4 June. The Assembly followed the next day.
Politics sat alongside policy. Bloomberg Government reported that Hochul signed the bills ahead of New York's gubernatorial election. It cited a 28 October Siena poll that put her 14 points ahead of Republican Bruce Blakeman.
Supporters outside the legislature were organized. Common Sense Media campaigned for the bill, and the Raine family lobbied for it, according to Syracuse.com. Assemblymember Alex Bores said the state now had the strongest child AI safety law in the country.
What do critics say, and will the law survive a challenge?
Business groups object to the scope. The Business Council of New York State opposed an earlier version, A10379A. In a May 2026 memo it called the bill "not a workable regulatory framework." It argued the definition would capture tutoring tools, coding assistants and customer-service bots.
The council made three further arguments. The age-verification mandate conflicts with the bill's own actual-knowledge standard, it said. Liability would attach to non-deceptive conduct. And an earlier draft's private right of action created open-ended litigation risk.
The signed text enforces Article 48 through the attorney general only. That is a meaningful difference from California's SB 243, which lets individuals sue. It removes private lawsuits as a route to enforcement and concentrates power in one office.
ITIF argues that states are recycling social media playbooks. It says age verification and broad content bans are poorly matched to chatbots. They would inconvenience adults and push platforms to collect more personal data. It recommends a device-level child flag set by parents and a federal approach instead.
Federal proposals exist but have not passed. ITIF points to the CHATBOT Act, introduced by Senators Ted Cruz and Brian Schatz in April 2026, which would emphasise parental controls. Until something passes, state attorneys general set the terms.
The bill also blocks contracts that waive or shift liability under the article. Terms of service cannot opt users out of the protections. Liability cannot be moved to another party in exchange for access.
Article 48 says the attorney general may add banned features through rulemaking. That provision turns the list into a moving compliance target, and it is one reason industry lawyers are watching the implementation period closely.
Compliance questions remain open. Companies must decide what counts as flattery and how to handle memory across sessions. They must also verify age without collecting more data than the law allows. The final perimeter is still undefined.
The Business Council's memo also flags constitutional and privacy concerns. No court has tested Article 48 yet. The first enforcement action will matter more than the signing.
What does the baby monitor law require, and what happens next?
The baby monitor law is narrower and older in inspiration. It takes effect 90 days after signing, which falls in late January 2027. New monitors that stream audio or video over the internet must include features that block unauthorized viewers. They must also carry a warning label.
The label has to be conspicuous and easy to understand. It must sit on the box or accompany the device in type no smaller than 12-point. The bill's model wording tells buyers that the product connects to the internet and that they should use the security features.
Penalties are modest: up to $250 for a first violation and $500 for later ones. Enforcement sits with municipal consumer affairs offices rather than the attorney general, according to the bill text. Local enforcement could produce uneven results across the state.
The governor's office cited a 2015 Rapid7 study of nine internet-connected monitors from eight vendors. Prices ranged from about $55 to $260. Eight received an F grade for security and one received a D. Rapid7 reported the findings to vendors in July 2015 and disclosed them publicly that September.
The law has limits. It covers devices marketed exclusively for infants, not phones or security cameras. It applies to new products rather than monitors already in homes. A decade-old security study is thin evidence for a 2027 product rule.
What to watch: the attorney general's rulemaking and complaint portal, and the first enforcement case after 1 January 2027. Another question is whether other states copy the age-assurance model. Congress has not passed a federal chatbot law.
For parents, the law changes which features a verified minor can reach, not whether chatbots exist. For developers, it turns age assurance and output filters into New York compliance requirements. Those requirements come with a fixed deadline and a public complaint channel.