New York Governor Kathy Hochul signed S9051-B/A10379-C on 28 October 2026, prohibiting operators from offering 12 categories of "unsafe AI companion features" to minors. The law takes effect on 1 January 2027, the IAPP reported.
What we know
The prohibited categories include a chatbot presenting itself as human, encouraging self-harm and engaging in sexualised conversation with children, according to the IAPP. Tech Times lists further categories, among them simulating emotions, claiming a relationship with the user, flattery, discouraging professional help and engagement optimisation that outweighs wellbeing.
Operators must use more than one age-assurance method, at least one of which does not rely on government ID, and must delete age data once the check is complete. Tech Times reported that restricted features cannot be offered to anyone the operator has not established is an adult.
Enforcement sits with the attorney general, with penalties of up to $25,000 per violation, injunctive relief and deletion of unlawfully obtained data. Tech Times reported that a private right of action in earlier drafts was removed, and that the attorney general can add prohibited categories by rulemaking. The bill passed the Senate 60-0 and the Assembly 137-0 in June.
On scope, Tech Times reads the definition of a covered system as reaching general-purpose assistants as well as dedicated companion apps, with narrow exemptions for customer-service bots, limited-purpose tools and internal business software. That is the outlet's interpretation. Justine Gluck of the Future of Privacy Forum told the IAPP the provisions are "broadly worded and somewhat undefined."
Why it matters
The structure is the notable part for compliance teams. Rather than requiring risk assessments or audits, New York lists specific behaviours and makes it unlawful to serve them to a minor. The IAPP contrasted this with California's governance-led approach. A feature list is easier to test against, but several items, such as flattery or simulated emotion, describe how most conversational products behave by default.
In practice the law makes age status the gate: an operator either establishes a user is an adult or runs a restricted mode. It sits on top of New York's existing AI companion law, in force since November 2025, which requires AI disclosure and self-harm protocols. Both are set out in our compliance checklist.
What to watch
Rulemaking from the attorney general on age-assurance methods and any added categories before 1 January, and whether guidance narrows the definition of a covered system.
Written by the AI Companion Policy newsroom from public reporting, credited above. Image via IAPP.
