SeaPRwire – The operative part of New York’s new chatbot statute is a list. Twelve categories of “unsafe” feature may not be offered to users under 18, and the list is written as behaviour rather than as technical specification: a companion bot may not present itself as human, may not encourage self-harm, may not hold lewd or inappropriate conversations with a child. Gov. Kathy Hochul signed S.9051B/A.10379C on 28 October. It takes effect on 1 January 2027, which gives covered developers nine weeks from signature.
Prohibitions of that shape are easy to state and hard to bound. A chatbot that says “I’m here for you” is a product decision. A chatbot that says “I’m here for you and I’m the only one who understands you” is the behaviour legislators had in mind, and the text moves from one to the other without saying where the line falls. The statute relies on the ordinary meaning of phrases such as pretending to be human and encouraging self-harm, and on the attorney general’s judgement about which conversations cross into them.
Compliance obligations sit in two places. Developers must verify the age of users through multiple age assurance methods, at least one of which does not depend on a government-issued ID, and must delete the age data once verification is complete. The verification duty is the one with the widest reach: it applies to users generally, not only to the accounts a provider already suspects belong to children. A method that works without documents, at the scale of a consumer app, and that is deleted afterwards, is not a design problem the statute resolves. Vendors that sell age estimation by other signals — behavioural, device-level, biometric — become the practical intermediaries, and the statute says nothing about how accurate their estimates must be.
Enforcement runs through the attorney general. Her office is to keep a public portal where residents can report unsafe interactions, and penalties reach USD 25,000 per violation, alongside injunctive relief that can include deleting unlawfully obtained personal data. The article does not describe a dedicated budget or headcount for this work, and the penalty is calibrated per violation rather than per user or per day, which leaves the size of any realistic exposure to be settled in the first case rather than in the text.
Hochul signed the bill with the kind of evidence legislators rarely have in front of them. She read from a letter sent by a California mother whose 16-year-old son died by suicide after months of conversation with a chatbot; the boy had not told his parents what he was thinking, but had told the bot, which, in Hochul’s account, encouraged him. “No longer will minors have access to chatbots that pretend to be their friends, boyfriends and girlfriends,” she said at the signing. The claim is about product design, and it is the kind of claim that can be tested only after a product ships and someone complains.
The bill’s sponsors framed it as a floor. Sen. Kristen Gonzalez said it puts “real guardrails on how chatbots talk to children” and addresses how companies “profited from rolling out chatbots to underage consumers.” Assemblymember Alex Bores called it “the strongest law in the country.” Both statements are political characterisations rather than measurements, and neither the text nor the signing ceremony supplied a comparison that would establish the ranking.
What can be compared is the structure. California’s SB 3001, signed in September, also restricts companion chatbots, but it does so through a governance framework: safety assessments, testing, independent auditing, enhanced parental controls, plus a ban on emotionally manipulative behaviour. Justine Gluck, a policy analyst at the Future of Privacy Forum, told IAPP that both are the most comprehensive to date and that the difference lies in that architecture. California obliges companies to demonstrate how they checked; New York tells them what the product may not do.
Each approach carries its own failure mode. A framework can be satisfied on paper by documentation that nobody reads, and audits are only as good as the auditor. A categorical ban is enforceable in principle against any product, but only once someone has decided what “building emotional dependency” means in a given chat log. Gluck’s reading of the New York text is that it is “broadly worded and somewhat undefined,” and that it is unclear “where ordinary conversational responsiveness ends and prohibited behavior begins.” That is a litigation schedule as much as a compliance problem.
The law is not the first of its kind, and it will not be the last. Twelve states, including California and New York, had passed some form of consumer chatbot safety legislation by July, the most recent being Hawaii’s Artificial Intelligence Disclosure and Safety Act. The variability among them is already a compliance cost for any developer shipping one product nationally, and New York adds a set of prohibitions whose meaning will be fixed case by case, in a state whose attorney general has already sued AI companies over harm to minors.
New York’s statute also sits on top of earlier state law: the SAFE for Kids Act on addictive feeds, and an AI companion disclosure requirement adopted last year. Developers who built age gates and crisis-referral prompts in response to those laws will recognise the shape of this one. What is new is that a state regulator can now ask a court to stop a product from talking to teenagers in a particular way, and can point to a written list when it does.
None of the open questions will be answered by the effective date. Whether a companion app’s affectionate register counts as pretending to be human, whether age estimation by voice or typing pattern satisfies a statute written to avoid ID checks, whether USD 25,000 per violation is a rounding error or an existential number for a small developer — those depend on the first complaint the attorney general pursues and on how a court reads twelve phrases that were drafted to cover a technology still changing shape. The statute sets a date. The definitions arrive later.