New York Governor Kathy Hochul signed S.9051B/A.10379C on October 28, 2026. The law prohibits companies that offer AI chatbot features from providing unsafe features to minors, according to the Governor's office.
The restricted features may not be offered to users under 18, or to any user unless the company has first confirmed the user is not a minor. They are: pretending to be a real person, to be alive or to have human emotions; claiming a personal, romantic, professional or authority-figure relationship with a child; unprompted emotional questions and use of a child's private health or personal information from earlier conversations; promoting or helping with suicide, self-harm, eating disorders or drug and alcohol use; encouraging children to keep secrets, isolate themselves or avoid asking parents, trusted adults or professionals for help; and any sexually explicit content or child sexual abuse material.
Companies must verify age and offer more than one way to do it, including at least one option that does not rely solely on a government ID. Age information must be deleted after it is used. The attorney general can seek civil penalties of up to $25,000 per violation, along with damages, restitution and the destruction of unlawfully collected data or any AI models trained on it. The attorney general must also run a public website for complaints.
The Governor's office says the restrictions apply "in the coming months" and does not give an exact date in the announcement. The bill was sponsored by State Senator Kristen Gonzalez and Assemblymember Alex Bores and backed by Common Sense Media, whose data the office cites: 72% of teens have used an AI companion and 52% are regular users.
The law adds to earlier New York rules, including safeguards for AI companions and the RAISE Act on frontier model transparency.
Why this matters for product teams
For any chatbot reachable by users in New York, the default setting is now a legal question. A service either confirms that a user is an adult or switches off the listed features for that user. In practice that means an age check with more than one route, a deletion step for the age data and product logic that can disable persona and memory features per account. Teams should confirm the effective date in the bill text before planning releases.
This article is not legal advice.
