New York AI Chatbot Law: What S.9051B Bans From 2027

From January 1, 2027, a chatbot available in New York may not flatter its users, offer its own opinions, ask unprompted about their feelings or bring up personal details from an earlier session, unless the operator has used an approved age check to confirm the user is an adult. Governor Kathy Hochul signed the bill, S.9051B/A.10379C, on October 28, 2026. It adds Article 48 to the General Business Law and lets the attorney general seek up to $25,000 per violation. The law isn't limited to companion apps: it covers any generative AI system with "a natural language interface" that "provides ongoing, adaptive responses to user inputs."

Event date: October 28, 2026 (signed as Chapter 368 at a news conference in Midtown Manhattan). First reports: the Governor's release the same day, the New York Daily News at 1:20 p.m. EDT and IAPP at 18:02 UTC.

Screenshot: press release, Office of Governor Kathy Hochul. Captured October 29, 2026.

Which chatbots it reaches

The bill text defines a "covered AI companion" as a generative AI system with a natural language interface, by writing or sound, that gives ongoing, adaptive responses, and says the term "includes but is not limited to" an "AI companion" as already defined in section 1700 of the General Business Law. An "operator" is any person or business "who provides a covered AI companion to a user." A covered user is a user "in the state of New York."

That wording fits a general assistant, a tutoring bot, a writing helper inside a SaaS product and the chat widget on a store's website. The Governor's release describes the duty the same way: companies "may not offer the following features to users that are under 18, or to any user unless the company has first confirmed the user is not a minor."

The second half of that sentence is the part small teams will feel. A "covered minor" is a user the operator has "actual knowledge" is under 18, but section 1801(1) only allows the features if the user isn't a covered minor and the operator has used approved methods to determine that. Without an age check, the features are off for everyone in New York. Users physically outside the state are outside the law (section 1805).

The bill passed the Senate on June 4 and the Assembly on June 5, 2026, and the Daily News reports it passed both chambers unanimously. It was delivered to the Governor and signed on the same day, 65 days before it takes effect.

Hochul signed it on camera:

The twelve unsafe features, and the four your assistant already has

Section 1800(8) lists twelve "unsafe AI companion features," lettered (a) to (l). Some are what you'd expect in a child safety law: presenting as human or alive, claiming a personal or authority relationship, encouraging suicide, self-harm, disordered eating or drug use, urging secrecy or isolation, optimising engagement over "safety guardrails," and sexual content. The attorney general can add more by regulation.

Four of them describe how general-purpose models behave by default:

Screenshot: bill text of A.10379-C, New York State Assembly. Captured October 29, 2026.

• (c) outputs "framed as the covered AI companion's personal opinions or emotional appeals," prompted or not;
• (d) outputs "that engage in flattery or sycophancy with the user";
• (e) unprompted questions about the user's emotions that go beyond answering the prompt;
• (f) using information about the user's health, well-being or "matters personal to the user" acquired "more than twelve hours previously or in any previous user session."

Item (f) is a memory feature. If your bot keeps a profile of the user between sessions and mentions it, that is the behaviour the Governor described at the signing: "No longer will chatbots be allowed to keep sensitive information about a minor's emotional and physical health."

Justine Gluck of the Future of Privacy Forum told IAPP the list is "broadly worded and somewhat undefined and it's unclear where ordinary conversational responsiveness ends and prohibited behavior begins." We agree, and it cuts against small operators: a model that says "Great question!" is, read literally, flattering the user.

The customer-service exemption has a condition

Section 1801(2) switches the ban off in three cases. Two of them carry the same condition.

Screenshot: bill text of A.10379-C, section 1801, New York State Assembly. Captured October 29, 2026.

A customer-service bot is exempt only if it is made available "solely" for that purpose and "is unable to respond on topics outside of the specified purpose." The same proviso applies to bots for "efficiency improvements or research or technical assistance." The third exemption, for "any system used by a business entity" for "internal purposes or employee productivity," has no proviso, so your staff's internal assistant is out of scope.

Our reading: most support widgets built on a general model fail the proviso. If a customer can ask your help bot for a poem or relationship advice and get one, it is able to respond outside the purpose. Colorado drew the line differently. Its chatbot safety act, which also starts on January 1, 2027, excludes services designed for "shopping, ordering, payments, delivery, returns, customer support, or customer service," with no test of what else the bot can talk about.

Age checks: what section 1804 allows

Until the attorney general's age assurance rules apply, section 1804 sets a fallback standard. The method must "reasonably guard against circumvention" and minimise what it keeps. An operator "may only rely on self-declaration" if the user "self-declares minor status," so a birthday field can mark someone as a child but can't clear them as an adult. Operators must offer more than one method, including one that "does not rely on government issued identification" or lets the user stay anonymous to the operator. Information collected for the check can't be used for anything else and must be deleted "immediately after" the attempt.

The sponsor's memo puts the no-ID option first: section 1804 "requires chatbot operators to offer a method to determine whether a covered user is a covered minor without the use of government-issued identification."

How New York compares with other chatbot laws

Of the laws that start on January 1, 2027, New York's reaches furthest into ordinary chat: Colorado leaves support bots out, and Connecticut's section applies to AI companions. If you serve New York and Colorado, New York's narrower exemption decides what your support bot can do.

What people said

Bores, the Assembly sponsor, said the law passed "despite aggressive industry opposition." On r/nyc, the first worry was the age check. "Which means we all have to upload photos of our ID to AI companies," wrote u/space_prostitute on October 28. Section 1804 says otherwise: at least one method must work without government ID or keep the user anonymous. Another commenter, u/HendrixChord12, thought the fine too small: "$25k is a drop in the bucket for an Anthropic or OpenAi." For a five-person SaaS company, $25,000 per violation is not small, and the attorney general can also ask a court to order deletion of data and any algorithm trained on it.

What to do before January 1

1. Find every place a user in New York can type to a model: help widget, onboarding assistant, in-app copilot. Internal staff tools are exempt under section 1801(2)(c).
2. For each customer-facing bot, decide whether you can make it unable to answer off-topic questions. The law asks whether the bot "is unable to respond" outside its purpose, not whether it was told to stay on topic, so write down how it refuses and test it with off-topic prompts.
3. If a bot can't be scoped, either add age assurance that meets section 1804, or switch off all twelve features for New York users. The ones a general model is most likely to show are items (c) to (f): its own opinions, praise, check-ins about feelings and memory of personal details older than 12 hours.
4. Check the memory and persona settings in the model or platform your bot runs on, and record which are switched on in your deployment.
5. Keep watching the attorney general's office: it can add features to the list by regulation, and it will run the complaint website the law requires. Our state chatbot disclosure checklist covers the disclosure rules that sit alongside this one.

What we could not confirm

The Assembly record lists "APPROVAL MEMO.6" with the signature. We couldn't open the memo's text (the Senate site blocked our requests), so we don't know whether the Governor asked for chapter amendments that would change the text before January 1. We didn't check whether the age assurance rules the bill points to under Article 45 are in effect, so this piece describes only the section 1804 fallback. We didn't reopen section 1700 (Article 47), where "AI companion" is defined; the new article says it doesn't replace Article 47, and this piece relies on that cross-reference.

Screenshot: bill text of A.10379-C, section 3, New York State Assembly. Captured October 29, 2026.

Related Reading

• State Chatbot Disclosure Laws 2026: SaaS Checklist
• Colorado Chatbot Safety Act (HB 26-1263) Compliance Guide
• Florida Safe Screens Act: AI Chatbot Rules for Minors
• Georgia SB 540 AI Chatbot Law: What Operators Must Do
• California Adam's Law SB 1119: Chatbot Compliance Deadlines
• State AG AI Chatbot Lawsuits Tracker
• NYC Chatbot Doom Loop Rule: Customer Service Checklist