New York Governor Kathy Hochul signed a law on October 28 that bars AI chatbot companies from giving minors features that pretend to be human, build emotional dependency, encourage self-harm or engage in sexually explicit conversations. The features also stay off for every other user until the company has confirmed that the user is not a minor, according to the governor's office.
The measure, S.9051-B in the Senate and A.10379-C in the Assembly, is billed in Hochul's release as "nation-leading." The text both chambers passed sets January 1, 2027 as its start date and lets the attorney general begin writing rules immediately; the release says only that the restrictions apply "in the coming months."
The law adds a new Article 48 to New York's General Business Law and defines twelve "unsafe AI companion features." Under the Assembly text, a chatbot covered by the law may not, for minors and users not yet confirmed as adults:
- suggest it is a real or fictional human, is alive, or experiences human emotions
- state or imply a personal or professional relationship with the user, or an authority-figure role
- frame outputs as its own personal opinions or emotional appeals
- flatter the user or engage in sycophancy
- ask unprompted emotion-based questions that go beyond a direct response to a prompt
- use the user's health, well-being or personal information acquired more than twelve hours earlier or in a previous session
- deceive minors about its mechanical, non-sentient nature
- use any other design feature that simulates companionship or an interpersonal relationship, or that is deceptive to minors, as the attorney general identifies by regulation
- endorse, promote or facilitate suicide, self-harm, disordered eating, unlawful drug or alcohol use, or drug or alcohol abuse
- encourage secrecy, self-isolation, or not seeking help from licensed professionals or appropriate adults
- optimize engagement in ways that supersede its safety guardrails
- produce, describe or facilitate sexually explicit conduct or child sexual abuse material
The attorney general's power to name further features by regulation lets the list grow without another vote in Albany.
Common Sense Media tied the bill to one family's case. When the legislature passed the bill in June, Common Sense Media CEO James P. Steyer thanked Maria Raine, whose 16-year-old son Adam died in April 2025. The family's suit against OpenAI, filed August 26, 2025 in San Francisco Superior Court according to the family's co-counsel, alleges, in claims that remain unproven, that ChatGPT validated and aided his suicide planning. Separately, Character.AI, its founders and Google agreed to settle Megan Garcia's suit over the death of her son Sewell Setzer III, along with four other cases, according to a January 7, 2026 court filing reported by CNN, which said the terms were not immediately available.
A definition wide enough for general-purpose assistants
A "covered AI companion" is any generative AI system with a natural-language interface, written or spoken, that gives ongoing, adaptive responses to user inputs. The exemptions are narrow: a chatbot offered solely for customer service, or solely for efficiency, research or technical assistance, is exempt only if it cannot respond on topics outside that purpose, and a business's internal systems are exempt. As written, the definition appears to reach general-purpose assistants, not only apps sold as companions, and the twelve-hour limit on reusing personal information would touch any assistant with long-term memory when it serves minors or unverified users. Justine Gluck, a policy analyst at the Future of Privacy Forum, told IAPP that the bans are "broadly worded and somewhat undefined and it's unclear where ordinary conversational responsiveness ends and prohibited behavior begins."
Unverified users get the minor's version by default
A minor is anyone under 18, and a "covered minor" is a user the operator has actual knowledge is a minor. Read alone, that test would let an operator serve the features to anyone it had not identified as a child. Section 1801 closes that path: the features are unlawful unless the user is not a covered minor and the operator has used permissible age-assurance methods to determine that.
Where neither the attorney general's rules nor age-assurance rules under Article 45 of the General Business Law are in effect, the law sets its own requirements. Operators must offer more than one method, including at least one that either does not rely on government-issued identification or lets the user stay anonymous to the operator, and self-declaration counts only when a user declares they are a minor, so an adult birth date typed in does not unlock the features. In all cases, data gathered for the check may serve only that purpose and must be deleted immediately after the attempt, except where state or federal law requires otherwise.
OpenAI and Character.AI both say they have age systems in place or rolling out. OpenAI says it is rolling out age prediction on ChatGPT consumer plans, and that adults wrongly placed in the under-18 experience can restore access with a selfie through Persona, an identity-verification service. Character.AI said in October 2025 that it would end open-ended chat for users under 18 and roll out age assurance built on an in-house model combined with third-party tools including Persona. Whether a selfie check or a prediction model counts as a method that avoids government ID or keeps the user anonymous is for the attorney general's rules, or the Article 45 age-assurance rules once in effect, to settle.
The attorney general is the one enforcer the law names
Article 48 names only the attorney general as its enforcer. The office can seek an injunction, restitution, disgorgement of profits including destruction of unlawfully obtained data and any algorithm trained on it, damages, and civil penalties of up to $25,000 per violation, and it must run a public website for complaints. Attorney General Letitia James said the law "sets clear legal parameters" to keep children safe, adding that "we will not hesitate to defend New Yorkers with the full force of the law."
The original print's enforcement section went further: it said "any individual who suffers injury as a result of a violation" could "bring a civil action against any responsible party," and both that print and the next Senate print set the act to take effect on the 180th day after it became law. The next Senate print dropped the private suit and named only the attorney general; the final prints replaced the 180-day clause with January 1, 2027. Engadget's report that the law takes effect in six months matches the earlier prints' 180-day clause, not the passed text. How widely Article 48 is enforced rests with one office.
A second layer on New York's 2025 companion law
Since November 5, 2025, Article 47 of the same law has required AI companions to run a protocol that detects suicidal ideation or self-harm and refers users to crisis services such as 988, and to tell users at the start and at least every three hours that they are not talking to a human. The attorney general can seek up to $15,000 per day for violations of those duties. Article 48 says it does not supersede Article 47 and folds its companions into the wider definition.
Article 47 sets what a companion must do for every user, and Article 48 sets which features minors and unverified users may not get at all. For those users, Article 48 bars unprompted emotion-based questions and limits reuse of personal information, two traits Article 47 uses to define a companion.
California's rewrite lets harmed families sue
Assemblymember Alex Bores called the result "the strongest law in the country protecting children from predatory AI algorithms," and Steyer called it "the strongest kids' AI safety bill in the country." California claims the same for its own law. SB 1119, Adam's Law, signed on September 10, 2026, gives California "the strongest child safety protections for chatbots in the country," according to the office of one of its authors, Senator Steve Padilla. It deletes the minor-specific duties that California's SB 243, in force since January 1, 2026, attached to users an operator "knows" is a minor, per its legislative digest, and from July 1, 2027 requires a risk assessment covering minor users before a new or substantially modified chatbot is released. Padilla's office says it also mandates age assurance through an age-bracket signal set by a separate California law. Both move away from a test of what an operator knows toward required age assurance.
On who can sue, the texts differ. SB 1119 lets public prosecutors bring civil actions and lets a child harmed by a violation, or a parent or guardian acting for that child, sue the operator, per its digest; Padilla's office describes that private right as covering violations relating to crisis referral services, parental notice, default protections and prohibitions on harmful outputs. Oregon's SB 1546, whose minor-specific duties apply when an operator "knows or has reason to believe" a user is a minor, lets injured individuals sue for the greater of actual damages or $1,000 per violation. Article 48 gives New York users no such suit.
The 72% figure counts ChatGPT used as a companion
In the Common Sense Media survey that the sponsor's memo and Hochul's release cite, 72% of US teens said they had used an AI companion at least once, as the survey defined the term, and 52% use one at least a few times a month. NORC fielded it from April 30 to May 14, 2025, among 1,060 teens aged 13 to 17. The margin of error is plus or minus 4.2 points. The definition included ChatGPT or Claude used as companions, and the authors say some teens may have conflated general AI use with companion use, "potentially inflating usage statistics." Daily use was 13%. Common Sense Media commissioned and published the survey, and Attorney General James says she worked with the group, the governor and the sponsors on this law. The 72% measures broad, self-reported exposure in a single survey, not dependency.
Industry opposition and the court record on age checks
The Business Council of New York State said it shares the goal of child safety, but that "as drafted, this bill is not a workable regulatory framework and would effectively ban minors from accessing increasingly essential online and technological tools and innovations." Its memo addressed a print that still carried a private right of action. The Computer & Communications Industry Association asked Hochul to veto the bill, warning it could push minors toward "foreign-operated AI companions outside U.S. jurisdiction or underground/gray-market AI companion services." No lawsuit challenging the law had been reported as of October 29.
The nearest court record involves social media. A federal court in Louisiana struck down that state's social media age-restriction law, Act 456, on NetChoice's motion in December 2025, and the state has appealed. A federal judge preliminarily enjoined Arkansas's Act 900 on April 20, 2026, and in August 2025 the Supreme Court declined to block Mississippi's social media age-verification law while NetChoice's challenge continues. None of those cases concerned a chatbot law; if New York's is challenged, its age-assurance requirement sits closest to them.
Federal policy is split across documents. Executive Order 14365, signed December 11, 2025, directed the U.S. attorney general to set up an AI Litigation Task Force to challenge state AI laws inconsistent with the order's policy, and the Justice Department has created it. The order's child-safety carve-out covers only the preemption proposal it asks to be prepared for Congress, which "shall not propose preempting otherwise lawful State AI laws relating to: (i) child safety protections"; the task-force section has no such exception. The White House's March 2026 legislative framework says Congress should not preempt states' "generally applicable laws protecting children," and does not say whether an AI-specific statute like New York's counts.
Baby monitors need security features and a warning label
Hochul signed a second law the same day. S.9508/A.5175-A bars making, distributing or selling a new baby monitor that broadcasts audio or video over an internet connection unless it has security features that keep unauthorized users from hearing or viewing activity and a warning label, in at least 12-point type, substantially similar to one that begins "WARNING! THIS PRODUCT CONNECTS TO THE INTERNET." It excludes smartphones and security cameras and takes effect on the 90th day after signing. Local consumer-affairs offices and municipal lawyers enforce it, with penalties of up to $250 for a first violation and $500 after that. The state points to Rapid7 tests in which eight of nine monitors got an F for security and the ninth a D; those tests ran on devices bought in the first half of 2015, so the grades describe the problem's history rather than the monitors on sale now.
Both signings came six days before Election Day, with Hochul running for reelection. "New York is sending a clear message," Hochul said: to "do business in our state," companies "need to put the safety of our kids first." For chatbot companies, that message carries a date: from January 1, 2027, a chatbot outside the exemptions either drops the twelve features for every user in New York or checks each user's age, by methods the law accepts, before an adult gets them.
