New York AI chatbot child safety law: age checks, $25K fines

New York Governor Kathy Hochul signed an AI chatbot child safety law on October 28. Chatbot companies must verify ages and must not offer a list of risky features to minors, or to any user they have not confirmed is an adult. The attorney general can seek up to $25,000 per violation. If your website or app has a chat window that sells to New Yorkers, this AI chatbot law is now part of your spec.

What actually happened

The bill is S.9051-B / A.10379-C, sponsored by Sen. Kristen Gonzalez and Assemblymember Alex Bores. According to the governor's release, companies that use AI chatbot features may not do these things with minors:

• Pretend to be a real person, to be alive, or to have human emotions.
• Claim a personal, romantic, professional or authority relationship with the child.
• Ask unprompted emotional questions, or reuse a child's private health or personal data from earlier chats.
• Promote suicide, self-harm, eating disorders, or drug and alcohol use.
• Tell kids to keep secrets or to avoid parents and other trusted adults.
• Produce sexually explicit content.

Companies must run age verification with more than one method. At least one method must not depend only on a government ID. They must delete the age data after use. The attorney general enforces the law, with civil penalties of up to $25,000 per violation, plus damages, restitution and the destruction of data or models built on unlawfully collected data.

Two points are not settled. Timing: the governor's office says "in the coming months." IAPP reports January 1, 2027, and Engadget reported six months. Scope: IAPP frames the law around companion chatbots and quotes a Future of Privacy Forum analyst who calls the prohibitions "broadly worded." Some outlets read it to reach general-purpose assistants and to exempt narrow customer-service bots. We have not confirmed those readings against the statute text, so we do not rely on them here.

Why the chatbot law matters for your business

The default is "minor until confirmed." The restrictions apply to any user the company has not confirmed is an adult. A chat widget with no age gate treats every visitor as a possible kid. Most small-business bots never ask.

Narrow bots are the safe design. A support bot that answers order status, hours and returns, and refuses everything else, is far from a "companion." A bot with a first name, a personality and "I totally get how you feel" lines is closer to the list above. Remove the persona before a regulator asks you to.

Memory is a liability. One banned item is reusing personal information from earlier conversations without a prompt. If your bot stores chat history across sessions, know what it keeps and why.

Sources: Office of Governor Kathy Hochul, IAPP, Engadget.