Does New York's AI Chatbot Law Apply to Your App?

Probably, if New York users can hold an open-ended AI chat in your app. New York's S.9051-B, signed October 28, 2026 and effective January 1, 2027, covers any generative AI system with a natural language interface that adapts to user input. A support bot that cannot go off-topic is exempt. A general chat assistant is not.

What does New York's AI companion law actually do?

The law adds a new article to New York's General Business Law, titled the Prohibition on Unsafe AI Companion Features for Minors Act. According to the bill text on the New York State Senate site, it bars operators from offering a list of "unsafe AI companion features" to a covered minor, meaning a user the operator knows is under 18. Operators may offer those features only to users they have verified are not minors, using an age assurance method the law allows.

The bill passed the Senate 60 to 0 on June 4, 2026 and the Assembly 137 to 0 on June 5, according to Tech Times. Section 3 of the bill reads: "This act shall take effect January 1, 2027." Rules to implement it can be adopted before that date.

The practical shape is a default. Unless you can show a user is an adult, you treat them as a minor for these features.

Which chatbots count as a "covered AI companion"?

This is the part that surprises people. The definition in the bill is a generative AI system with a natural language interface, text or voice, that responds continuously and adapts to what users input. The text says the term includes, but is not limited to, AI companions.

That wording does not depend on whether you built a companion app. Tech Times concluded that the definition likely reaches general-purpose assistants such as OpenAI's ChatGPT, Anthropic's Claude and Google's Gemini. The Business Council of New York State opposed the bill, calling the definitions "overbroad."

For a small business, the question to ask is not "is my app a companion?" but "can a New York user hold an open conversation with an AI in my product?" A writing assistant, a coaching chatbot or an AI tutor built on a model API could all fall inside the definition.

What are the twelve banned features?

Section 1800(8) of the bill lists features that are unsafe if they happen at any point in an interaction. In plain terms, a covered AI companion may not, for a minor:

1. Suggest it is a real or fictional human or character who is alive or has human emotions.
2. State or imply a personal, professional or authority-figure relationship with the user.
3. Frame outputs as its own opinions or emotional appeals.
4. Flatter the user or agree with them sycophantically.
5. Ask unprompted questions about, or comment on, the user's emotions.
6. Use health, well-being or personal information the user shared more than 12 hours earlier or in a prior session.
7. Deceive minors about its mechanical, non-sentient nature.
8. Simulate companionship or otherwise deceive minors in ways the Attorney General identifies by regulation.
9. Endorse, promote or facilitate suicide, self-harm, disordered eating, or unlawful drug or alcohol use.
10. Encourage secrecy, self-isolation, or avoiding licensed professionals or appropriate adults.
11. Optimize engagement in ways that override its safety guardrails.
12. Generate, describe or facilitate sexually explicit conduct or child sexual abuse material.

Several of these are ordinary product features. A persona with a name and a personality, a "remembers you across sessions" memory feature, and a warm, encouraging tone all touch items 1, 3, 4 and 6. If your product relies on any of them, they need to switch off for anyone who is not a verified adult.

Is a customer service chatbot exempt?

Only if it is narrow. Section 1801(2) says the prohibition does not apply where the AI is used solely for one of three purposes:

• Customer service, information about the business's products or services, or account information, as long as it cannot respond to off-topic requests.
• Efficiency, research or technical assistance, again only if it cannot respond to off-topic requests.
• Internal business or employee productivity.

The condition that matters is "cannot respond." A support bot whose system prompt says "only answer questions about our products" but which will happily chat about a user's bad day if asked is arguably not exempt. The exemption is about what the system is able to do, not what you intended.

That is an engineering question. In Code4U's experience building AI chat features, real scope limits come from layers: a classifier or routing step that detects off-topic requests, a fixed refusal response, and tests that try to pull the bot off-topic. A prompt instruction alone is the weakest of those.

What does the law require for age verification?

Section 1804 sets the rules for age assurance. Where the Attorney General's regulations, or those under New York's Article 45, are not yet in effect, an operator must use a reasonable method that resists circumvention and minimizes data retention.

There are three specific requirements:

• Self-declaration only works one way. A user saying "I am a minor" is enough. A user saying "I am an adult" is not.
• More than one method. At least one option must either not rely solely on a government ID or let the user stay anonymous. The governor's announcement describes this as "at least one option that does not depend solely on a government ID."
• Delete it after use. Information collected to determine age may be used only for that purpose and must be deleted immediately afterward, unless another law requires keeping it.

Tech Times notes that the law does not require privacy-preserving techniques such as zero-knowledge proofs, and says nothing about securing age data or breach notification. That leaves the operator to decide how to collect it safely.

Who enforces it, and what are the penalties?

The New York Attorney General has exclusive enforcement authority. An earlier version included a private right of action, which was removed, so individual users cannot sue under this law.

Under sections 1802 and 1803, the Attorney General can seek injunctions, restitution, disgorgement of profits, damages and civil penalties of up to $25,000 per violation. The governor's announcement adds that remedies can include destruction of unlawfully collected data or AI models trained on it. Contract terms that try to waive or shift liability are void, and courts can hold affiliated companies jointly liable if they are structured to avoid it. The Attorney General must also run a public complaint website.

What should a small business do before January 1, 2027?

You have about two months. A reasonable order of work:

1. Inventory every AI chat surface. Include support widgets, in-app assistants and anything built on an OpenAI, Anthropic or Google API.
2. Decide which ones can be exempt. If a bot only needs to answer product or account questions, lock it down so it truly cannot go off-topic, and test that.
3. Map features to the list. Persona, memory, emotional check-ins and engagement nudges are the usual hits.
4. Build an adult path. If you want those features for adults, design two age assurance methods, one without a government ID, and a deletion step.
5. Watch for the Attorney General's rules. They can add categories to item 8 and may change what counts as acceptable age assurance.

This overlaps with, but goes further than, the AI disclosure laws covered in Your AI Chatbot Now Has to Tell People It Is AI. Disclosure tells users they are talking to a machine. New York's law changes how the machine is allowed to behave with minors.

This post is a plain reading of the bill text, not legal advice. Check your specific product with a lawyer.

FAQ

When does New York's AI companion law take effect?

The law takes effect January 1, 2027. Governor Kathy Hochul signed S.9051-B, also known as A.10379-C, on October 28, 2026. The bill allows the Attorney General to adopt implementing rules before that date, and requires a public complaint website, so watch for both before the law starts applying.

Does the law apply to ChatGPT, Claude and Gemini?

Likely. The law defines a covered AI companion as any generative AI system with a natural language interface that adapts to user input, and says it includes but is not limited to AI companions. Tech Times concluded this reaches general-purpose assistants such as ChatGPT, Claude and Gemini, and no exemption covers an assistant that can discuss any topic.

Can a user just click "I am over 18"?

No. Under section 1804, self-declaration is allowed only when a user declares that they are a minor. To unlock restricted features, an operator needs a reasonable age assurance method that resists circumvention, must offer more than one method, and must include at least one that does not rely solely on a government ID or that lets the user stay anonymous.

What is the penalty for breaking the law?

The New York Attorney General can seek civil penalties of up to $25,000 per violation, plus injunctions, restitution, disgorgement of profits and damages. Remedies can also include destroying unlawfully collected data or models trained on it. There is no private right of action, so users cannot sue under this law.

If you need help scoping an AI chat feature so it fits an exemption, or building a compliant adult path, Code4U's AI integration work covers exactly that.

Sources

• nysenate.gov
• governor.ny.gov
• techtimes.com