New York: Kathy Hochul signs law on chatbots accessible to minors

Governor Kathy Hochul signed a New York State law on October 28, 2026, regulating certain features of chatbots accessible to minors. The legislation, recorded as chapter 368, will take effect on January 1, 2027.

The measure applies to certain generative artificial intelligence systems capable of responding in natural language continuously and adaptively, including AI companions. It defines features considered dangerous and provides exemptions for certain systems.

Operators must block these features when they have actual knowledge that a user is under 18. They must also block them until the operator has established, using an authorized method, that the user is an adult.

The legislation addresses, among other things, the simulation of a personal or professional relationship and a system presenting itself as human or as having emotions. It also targets flattery or sycophancy, as well as responses that optimize engagement at the expense of safety safeguards.

The law also covers encouragement of self-harm, suicide or other dangerous behavior, urging users to keep secrets or isolate themselves, and certain sexually explicit content.

Verifying age and limiting data collection

To access the features concerned, users may have to prove they are adults. Self-declaration is sufficient only to declare that one is a minor. Pending the relevant regulations, operators will have to offer several methods, including at least one that does not require government-issued identification or that allows users to remain anonymous to the operator.

Pending those regulations, a reasonable method must reasonably limit circumvention and data retention. Information collected to determine age cannot be used for any other purpose and must be deleted immediately after the attempt, unless an applicable law or regulation requires its retention. The effect on privacy will depend on the methods chosen and how they are applied.

The law provides exemptions for certain systems devoted exclusively to customer service or certain commercial information, efficiency, research or technical support, provided they do not respond outside their intended purpose. Systems used internally by a company or for its employees’ productivity are also exempt.

The legislation had been passed by the Senate on June 4, 2026, and then by the Assembly on June 5. It applies to conduct occurring wholly or partly in the state, while access by a person physically located outside New York is deemed to occur entirely outside the state.

The attorney general may bring an action in court and seek, among other remedies, injunctions, relief and civil penalties of up to $25,000 per violation. Preparation of the necessary regulations is authorized immediately.