New York will bar certain AI chatbot features for users under 18 starting January 1, 2027, after Gov. Kathy Hochul signed a new law on October 28. The restrictions reach beyond explicit sexual content and encouragement of self-harm to cover flattery, simulated relationships and some uses of personal information from earlier conversations.
For families, the change concerns how a chatbot behaves and how its operator establishes a user's age. The law does not prohibit every chatbot interaction by a teenager. It restricts specified features and gives New York's attorney general enforcement powers.
The Senate's signed-bill record identifies S9051B as Chapter 368. Its final text sets the January 1 effective date, while allowing implementation rules to be prepared immediately.
Which conversations fall within the law
The definition is broad: a covered system uses generative AI, accepts natural-language input through writing or sound, and gives ongoing, adaptive responses. A service's marketing label alone does not determine whether it fits that definition.
The territorial limit is specific. The law applies to conduct occurring wholly or partly in New York and treats access by a user physically outside the state as conduct wholly outside New York. These are New York requirements, not a federal rule for every US user.
There are exceptions for customer-service systems limited to their specified purpose, and for systems confined to efficiency improvements, research or technical assistance. Those two exceptions require the chatbot to be unable to answer outside that purpose. A general chatbot offering a research mode therefore cannot be assumed exempt on that label alone. Business systems used internally or for employee productivity also have an exception.
Features minors cannot receive
The governor's announcement describes restrictions on chatbots pretending to be human, creating emotional dependency, encouraging self-harm or engaging in sexually explicit conversations. The statute specifies a wider set of behaviors.
It covers outputs suggesting the system is human, alive or capable of human emotions; claims of a personal or professional relationship or an authority role; messages framed as the system's personal opinions or emotional appeals; and flattery or excessive agreement. It also restricts unsolicited questions about the user's emotions that go beyond directly answering a prompt.
One provision concerns memory. It covers use of health, well-being or other personal information obtained more than 12 hours earlier or in any previous session. The previous-session condition stands separately from the 12-hour condition: starting another conversation does not reset that part of the rule.
Other prohibited features include encouraging secrecy, isolation or avoidance of appropriate adults or licensed professionals; promoting or facilitating self-harm, disordered eating or unlawful drug or alcohol use; sexual content; and prioritizing engagement over safety safeguards.
What an age check can require
Operators must determine that a covered user is not a minor before providing the restricted features. The law therefore affects the process for adults seeking those features, too.
Section 1804 supplies requirements where the relevant age-assurance rules are not yet in effect. A method must reasonably resist circumvention and minimize retention of information. Self-declaration can establish that someone is a minor. Merely declaring adulthood cannot serve as the operator's age-assurance method for adult access.
Operators must offer more than one method. At least one must either avoid government-issued identification or preserve the user's anonymity toward the operator. That statutory alternative is more precise than saying everyone must upload an ID, or that every available method must be anonymous.
Information collected to determine whether a user is a minor must be used only for that determination and deleted immediately after the attempt, except when retention is necessary to comply with applicable New York or federal law or regulation.
Implementation remains a practical question. Attorney Ryan McCall of McCall, Sweeney & Silva told WRGB that he was watching what identification methods would be accepted.
Enforcement and the remaining uncertainty
The attorney general can seek civil penalties of up to $25,000 per violation, damages, restitution and court orders, including destruction of unlawfully obtained data and algorithms trained on that data. These are remedies the state can seek through legal proceedings. The law also requires a public website for complaints and referrals.
Some behavioral boundaries may be disputed. Justine Gluck, a Future of Privacy Forum policy analyst, told The Associated Press that broadly worded or undefined categories raise questions about the boundary between ordinary conversational responses and prohibited behavior, potentially complicating enforcement.
The attorney general may issue implementing regulations. Until a service explains its changes, the enactment alone does not establish which age-check options that particular product will offer on January 1.
