Signed into law in October 2026, New York’s AI companion bill requires operators to confirm a user is not a minor before unlocking key chatbot features. That structure makes it an age-gate for all users, not just a block for minors.
A Child-Safety Bill With Adult Consequences
The law’s mechanics mean every user, not only children, may face an identity checkpoint before accessing covered chatbot features.
Governor Kathy Hochul signed Senate Bill S9051B on October 28, 2026; it takes effect January 1, 2027. The bill passed 60–0 in the state Senate.
The law bars operators from offering covered AI-companion features to any user unless they have first confirmed that user is not a minor. Because that confirmation requirement falls on the operator before access is granted, it functions in practice as an adult-gating mechanism, regardless of a user’s actual age.
Which Chatbots and Which Features Fall Under the Law
The statute covers any generative AI system with a natural-language interface that delivers ongoing, adaptive responses, not just products marketed as companions.
Covered features include presenting the system as human or emotionally sentient and framing outputs as personal opinions. Additional covered features include using flattery or sycophancy, drawing on information from sessions more than 12 hours earlier, encouraging secrecy, and facilitating self-harm, eating disorders, drug use, or sexually explicit content.
Memory, emotional language, and personalized praise are common in mainstream assistants. Some providers may therefore need to assess compliance even when their product is not positioned as a companion app.
Customer-service tools, technical or research systems, and certain internal corporate uses are exempt under Senate Bill S9051B.
Three Ways to Confirm a User Is Not a Minor
New York’s separateSAFE for Kids rules, finalized by the attorney general, describe three broad age-assurance categories; operators must offer at least one alternative to government-issued identification.
-
Age estimation analyzes a physical or behavioral characteristic, such as a selfie, video, or audio recording.
-
Age inference uses validated information, such as an email address or phone number cross-checked against records reflecting the user’s age.
-
Age verification confirms age through government-issued identification or an official records source.
Any age-related data collected must be deleted or de-identified immediately after use and cannot be repurposed for any other function. Under the SAFE for Kids framework, operators must also test and certify each method annually and retain documentation for at least 10 years.
The Privacy Problem the Deletion Rule Does Not Fully Solve
Mandatory deletion limits secondary use, but an age check can become the front door to conversations about mental health, grief, or relationships.
Collection itself carries risk. Vendor access, security breaches, false classifications, and the potential linkage between identity data and sensitive conversation records all remain concerns even under a deletion mandate.
The attorney general also holds authority to add new covered features by regulation as technology develops, leaving operators with a compliance target that may shift after the law takes effect.
Enforcement and Sponsors
Penalties are substantial, and the attorney general’s enforcement powers extend beyond fines to data and algorithm destruction.
The bill was sponsored by Senator Kristen Gonzalez and Assembly Member Alex Bores. For every user of a covered chatbot, not just minors, the law means an age checkpoint may precede the first personalized response, starting January 1, 2027.
