Hochul Signs Law Limiting Chatbot Features for Minors
New York Governor Kathy Hochul signed a chatbot safety law on 28 October 2026. It bars chatbots from presenting themselves as human, claiming feelings or personal relationships, and encouraging self-harm when the user is under 18, or when the operator has not confirmed the user is an adult. Operators must offer age checks, including at least one method that does not rely only on government ID, and must delete the age data afterwards. The state attorney general enforces the law, with civil penalties of up to $25,000 per violation. The law takes effect on 1 January 2027. Reports differ on whether general-purpose assistants fall within its scope, so any business that runs a chatbot for staff or customers in New York should check its own set-up now.
In short
- Governor Kathy Hochul signed the chatbot safety law on 28 October 2026.
- The law bars 12 categories of chatbot behaviour toward users under 18 or unverified users.
- Reports disagree on whether general-purpose assistants such as ChatGPT and Gemini are covered.
- Civil penalties reach $25,000 per violation, enforced by the state attorney general.
- Start date is reported as 1 January 2027 by some outlets and 1 June 2027 by others.
Governor Hochul signed the bill, Senate Bill S9051B and Assembly Bill A10379C, on Wednesday 28 October 2026 at a ceremony in New York. According to the governor's office, the law is aimed at chatbots that pretend to be friends or romantic partners, keep sensitive health information about a minor, or steer children away from licensed professionals. The Times Union reported the same day that the bill bans what it calls unsafe chatbot features for minors, and that it was signed alongside a separate law on internet-connected baby monitors.
What the law covers
The Institute of Association Professionals (IAPP) describes the law as banning companion chatbots for children that engage in 12 prohibited categories of behaviour. Among them, chatbots may not claim to be human, claim to be alive, or claim to have human emotions. They may not suggest a personal, romantic, professional or authority-figure relationship with a minor. They may not flatter users in a way that drives engagement, and they may not endorse self-harm, eating disorders or unlawful drug use, according to the Transparency Coalition's account of the bill.
The scope question is where reports diverge. TechTimes reports that the law's definition of a covered AI companion is broad enough to reach ChatGPT, Claude and Google Gemini, not only dedicated companion apps. The Business Council of New York State raised the same concern in a formal opposition letter before the bill passed, arguing that the definitions were overbroad. Nexstar, in a report carried by WWLP, lists ChatGPT, Gemini, Meta AI and Character.AI among the services the bill governs. Other reports describe the bill mainly as a rule for companion apps. The official text is the authority on scope, and the attorney general's interpretation will matter once the law is in force.
Why it matters for businesses that automate work
Most business automation does not look like a companion app. A reconciliation bot, a billing assistant or a document drafting tool does not usually talk to children. The risk is indirect. Many businesses deploy a general-purpose assistant on a shared login, a public website or a customer portal, and a minor can reach it. If the operator has not confirmed that every user is an adult, the bill's restrictions may apply to that deployment.
The timing also matters. TechTimes calculates 65 days between the signing and the compliance date, which matches a 1 January 2027 start. The IAPP and the Transparency Coalition both give that date. A Nexstar report carried by WWLP gives 1 June 2027 for the chatbot rules, and Engadget describes the effective date as six months after signing. The reports do not agree, so the date should be confirmed against the enrolled bill before any plan is set.
What changes in practice
For a business that runs a chatbot, three things need a decision before the effective date.
- List every chatbot or AI assistant in use, including tools staff use on their own accounts, and note which ones are open to the public.
- Decide how each tool will tell an adult from a minor. The law requires more than one age-assurance method, and at least one must not depend only on government ID. Age data must be deleted after the check.
- Switch off the barred features for any user who is not confirmed as an adult, or limit the tool to staff accounts that are tied to an employer.
A five-person firm that uses a chatbot on its website faces the same decisions as a large group with thousands of staff. The difference is the number of tools to review. The law does not require a business to stop using AI at work. It targets specific behaviours in chatbots that may be used by minors.
| Item | What reports say |
|---|---|
| Signed | 28 October 2026, by Governor Kathy Hochul |
| Enforced by | New York Attorney General Letitia James |
| Penalty | Civil penalties of up to $25,000 per violation, plus damages and restitution |
| Start date | 1 January 2027 (IAPP, Transparency Coalition); 1 June 2027 (Nexstar via WWLP) |
| Data | Age data must be deleted after verification; the state may order destruction of unlawfully collected data and models trained on it |
Limits and open questions
The law does not ban minors from using chatbots. It restricts specific features when a user is a minor or is not confirmed as an adult. Age checks themselves raise privacy questions, because operators must collect data to verify age and then delete it. Automated checks can also misclassify adults. Any business that automates age checks should keep a human route for users who are wrongly flagged.
What to watch next
Three developments will show how far the law reaches. The first is the attorney general's guidance on whether general-purpose assistants are covered. The second is how the services named in press reports respond with age checks or feature changes before the start date. The third is whether other states follow. Common Sense Media, which backed the bill, has said other states might pass similar laws. Businesses should also watch for the baby monitor law, which the governor signed the same day, because it sets its own timeline.
This explains the rule in general terms; it is not legal or tax advice for your case.
How AiStaffo would automate this
AiStaffo would start with an inventory of every chatbot and AI assistant the business uses, including public website tools and staff accounts, and record which ones a minor could reach. Where an AI worker handles billing questions, follow-ups or document requests, the workflow would be set to switch off the barred features for any user not confirmed as an adult. Age checks would run through the method the business chooses, and the system would delete age data after verification, as the law requires. A person would still decide on the age policy, review the flagged cases and confirm the scope with counsel. Book a free automation audit to map which of your tools this affects.
Questions people ask
Did New York ban children from using chatbots?
Does the New York chatbot law cover ChatGPT, Claude or Gemini?
How much can a company be fined under the law?
When does the law take effect?
What does age verification mean for a business?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
