New York has enacted a law restricting the features that covered AI chatbots may provide to minors and to users whose adult status has not been established. Governor Kathy Hochul signed S9051B/A10379C on October 28, 2026. The law takes effect January 1, 2027.
The law is not limited to products marketed as AI companions. Its definition can reach other conversational generative AI products, including AI characters, creator replicas, roleplay tools, and general-purpose chatbots. Businesses offering these features to users in New York should review their products, age-assurance systems, and data practices before the effective date.
Which Products Are Covered
A “covered AI companion” is a generative AI system with a natural-language interface, including text or voice, that provides ongoing, adaptive responses to user inputs. A business does not avoid the law simply by calling its chatbot an assistant rather than a companion.
The restrictions concern users physically located in New York. An operator need not be located in New York to face enforcement. Conversely, the statute treats access by a user physically outside New York as conduct wholly outside the state. The focus is the user’s location, not merely residence.
The law contains limited exceptions for systems made available solely for specified purposes:
- Customer service and information strictly related to a business’s products, services, or customer accounts.
- Efficiency improvements, research, or technical assistance.
- A business’s internal purposes or employee productivity.
For the first two exceptions, the system must be unable to respond on topics outside its specified purpose. Merely describing an open-ended chatbot as a customer-service or research tool does not establish an exception.
There is no express general exemption for adult-oriented businesses. Whether an adult platform, creator service, or other online business is affected depends on the AI functionality it actually provides.
Which Features Are Restricted
The law identifies twelve categories of “unsafe AI companion features.” They extend beyond sexually explicit content and encouragement of self-harm.
Restricted features include outputs suggesting that the chatbot is human, alive, or capable of human emotions; outputs claiming or implying a personal or professional relationship or an authority role; responses framed as the chatbot’s personal opinions or emotional appeals; and flattery or sycophancy.
The law also addresses unsolicited questions or content about a user’s emotions that go beyond directly answering a prompt. It restricts the use of information about a user’s health, well-being, or personal matters when that information was acquired more than twelve hours earlier or during any previous session. That provision warrants particular attention from businesses using persistent memory to personalize conversations.
Other restricted features include:
- Deception concerning the chatbot’s mechanical, non-sentient nature, and additional companionship or deceptive features identified through Attorney General regulations.
- Endorsement, promotion, or facilitation of suicide, self-harm, disordered eating, unlawful drug or alcohol use, or drug or alcohol abuse.
- Encouragement to keep interactions secret, self-isolate, or avoid help from licensed professionals or appropriate adults.
- Outputs that prioritize user engagement over safety safeguards.
- Outputs that constitute, describe, or facilitate sexually explicit conduct or child sexual abuse material.
These are statutory feature restrictions, not simply a requirement to display an AI disclosure. A disclaimer that a chatbot is not human does not, by itself, resolve prohibited behavior elsewhere in the interaction.
Age Assurance Is Central To Compliance
Unless an exception applies, an operator may provide the restricted features only if the user is not a covered minor and the operator has used the required age-assurance methods to determine that status. Businesses cannot simply assume that a user is an adult because the service’s terms prohibit minors.
The law refers to permissible methods under New York’s SAFE for Kids Act and its implementing regulations, together with any additional regulations issued for this law. To the extent the relevant rules are not yet effective, the statute supplies an interim standard. Under that standard, operators must use reasonable age assurance that guards against circumvention and minimizes retention of collected information.
The interim standard also requires operators to offer more than one age-assurance method. At least one must either avoid reliance on government-issued identification or allow the user to remain anonymous to the operator. This is a requirement to offer alternatives, not a requirement that each user complete multiple methods.
Self-declaration can establish minor status under the interim standard. It cannot, standing alone, establish adult status. An “I am 18 or older” checkbox therefore is not sufficient under that standard.
Unlike the SAFE for Kids Act’s provisions governing certain social-media features, this law does not provide a parental-consent alternative allowing minors to receive the restricted chatbot features.
Age Assurance Data Requires Separate Controls
Information collected to determine whether a user is a covered minor cannot be repurposed for advertising, personalization, model training, or other unrelated uses. The statute requires deletion immediately after an age-determination attempt, except when retention is necessary to comply with applicable New York or federal law or regulation.
Businesses should examine the actual data flow, including what their age-assurance vendors collect, return, retain, and disclose. A privacy-policy revision will not cure a system that retains or reuses information contrary to the statute.
Enforcement Carries Substantial Exposure
The New York Attorney General may seek injunctions, restitution, disgorgement, damages, and civil penalties of up to $25,000 per violation. Available relief includes destruction of unlawfully obtained data and algorithms trained on that data.
The law also invalidates contract provisions that seek to waive, prevent, or burden enforcement of liability under the statute, or shift that liability to users in exchange for access. In specified circumstances, courts must impose joint and several liability on affiliated entities when a corporate structure was deliberately and unreasonably arranged to avoid liability and would frustrate recovery.
The enacted statute provides Attorney General enforcement. It does not create the private enforcement mechanism that appeared in an earlier version of the bill.
What Businesses Should Do Now
Businesses offering conversational AI should:
- Determine whether the product and its actual capabilities fall within the law. Review any claimed exception against how the system operates, including whether it can respond outside its stated purpose.
- Map the restricted features. Examine prompts, personas, generated responses, memory, personalization, engagement features, and safety controls. Identify what must remain unavailable to minors and users whose adult status has not been established.
- Review age assurance and location handling. Evaluate existing methods against the applicable standards rather than assuming that an adult-only policy or an existing age gate is sufficient.
- Review data handling and vendor arrangements. Address collection, permitted uses, deletion, and implementation responsibilities without retaining prohibited age-assurance data as a substitute for compliance documentation.
- Update the product and supporting documents together. Terms, privacy notices, AI disclosures, and internal procedures should accurately reflect functioning controls.
The January 1, 2027 effective date should not be confused with the January 25, 2027 effective date announced for the SAFE for Kids Act. That later date does not postpone this law. Businesses should also monitor additional Attorney General rules and any subsequent legal developments affecting implementation.
Contact Silverstein Legal to evaluate whether your AI features are covered and what product, age-assurance, privacy, and contractual changes are needed before January 1.
This article does not constitute legal advice and is provided for your information only and should not be relied upon in lieu of consultation with legal advisors in your own jurisdiction. It may not be current as the laws in this area change frequently. Transmission of the information contained in this article is not intended to create, and the receipt does not constitute, an attorney-client relationship between sender and receiver.
About Silverstein Legal
Founded in 2006 by adult entertainment lawyer Corey D. Silverstein, Silverstein Legal is a boutique law firm that caters to the needs of anyone working in the adult entertainment industry. Silverstein Legal’s clients include hosting companies, affiliate programs, content producers, processors, designers, developers, and website operators.
Related Articles
