On 28 October 2026, New York Governor Kathy Hochul signed a law, S.9051B/A.10379C, that limits what AI chatbot features can do with children. The law covers companies that offer AI chatbot features, and it applies to users under 18 as well as to any user until the company has confirmed that person is not a minor. The privacy news site IAPP reports that it takes effect on 1 January 2027.
The six banned features
The governor's office lists six kinds of behavior that chatbots may not offer to minors, or to anyone whose age has not been confirmed:
- Pretending to be a real person, to be alive or to have human emotions.
- Claiming a personal, romantic, professional or authority-figure relationship with a child.
- Asking unprompted emotional questions, or using a child's private health or personal information from earlier conversations.
- Promoting or helping with suicide, self-harm, eating disorders or drug and alcohol use.
- Encouraging children to keep secrets, isolate themselves or avoid asking parents, trusted adults or professionals for help.
- Producing sexually explicit content or child sexual abuse material.
IAPP describes the law as having 12 prohibited categories, and Fortune mentions limits on flattery or people-pleasing replies. The governor's summary groups the rules into the six above, so check the statute itself if you need the exact wording.
How the age checks work
The law does not simply demand a passport scan. According to the governor's office, companies must offer multiple age assurance methods, including at least one option that does not depend solely on a government ID. Age information must be deleted after it has been used. That design is meant to protect children without forcing every adult to hand over identity documents to talk to a homework helper or a customer service bot.
The penalties
Enforcement sits with New York's attorney general, who can seek civil penalties of up to $25,000 per violation, plus damages and restitution. The attorney general can also ask for the destruction of unlawfully collected data and of any AI models trained on it. The governor's office says the attorney general must also run a public website for complaints. That last remedy, deleting a model, is the one product teams should take most seriously, because it reaches the thing they spent the most time building.
Some experts have questioned how the rules will be read in practice. IAPP quotes a Future of Privacy Forum analyst describing the prohibitions as broadly worded and somewhat undefined, so expect guidance and possibly legal challenges before the details settle.
Why it matters outside New York
New York is not alone. IAPP reports that 12 states had passed chatbot safety laws as of July 2026. Companies rarely build a separate chatbot for each state, so a strict rule in one large state tends to become the default design everywhere. It echoes the early days of children's privacy rules online, when websites rebuilt their sign-up flows for everyone instead of just for one audience.
What to do this week
If you build, buy or market a chatbot, run through this checklist:
- Read the persona prompt for any claim to be human, alive or to have feelings.
- Check what the memory feature recalls about health or personal details, and whether it brings them up unprompted.
- Map your age check and make sure there is an option that does not rely only on a government ID.
- Test how the bot responds when a teen mentions self-harm, and make sure it points them to real help.
Our honest view is that this list works as a sensible design checklist even if you never serve a user in New York. Parents can find plain-English explainers on the main assistants in Learn, and our piece on Sweden's government blocking ChatGPT and Claude covers another way governments are setting AI rules.