New York’s New Chatbot Law for Minors: The Banned Features, the Age Checks and the Model-Deletion Remedy

New York has a new law on what AI chatbots may say to children. Governor Kathy Hochul signed S.9051B/A.10379C on October 28, 2026, banning a list of chatbot features for users under 18: bots that pretend to be human, claim a romantic or authority relationship with a child, push emotional questions the child did not ask, or encourage self-harm, among others. The bill became Chapter 368 of the Laws of 2026.

The law reaches further than a content filter. It requires providers to verify age, offer more than one way to do it, and delete age data after use. It gives the attorney general penalties of up to $25,000 per violation and the power to seek destruction of unlawfully collected data or of any AI models trained on it. That last remedy is unusual, and it is the one model developers will read twice.

The features that are now off limits for minors

According to the governor’s announcement, companies may not offer the following to users under 18, or to any user unless the company has first confirmed the user is not a minor:

• Pretending to be a real person, to be alive, or to have human emotions.
• Claiming a personal, romantic, professional or authority-figure relationship with a child.
• Unprompted emotional questions, and using a child’s private health or personal information from earlier conversations.
• Promoting or helping with suicide, self-harm, eating disorders or drug and alcohol use.
• Encouraging children to keep secrets, isolate themselves, or avoid asking parents, trusted adults or professionals for help.
• Any sexually explicit content or child sexual abuse material.

The bill text organizes these into broader categories of unsafe features. The structure is important: the default is that a chatbot with these features is for adults only. A provider that wants to keep them has to show the user is not a minor. A provider that cannot verify age has to switch them off for everyone.

Age verification with a privacy condition attached

The law requires age verification and requires more than one method, including at least one that does not depend solely on a government ID. It also requires that age information be deleted after it is used. That combination tries to answer the most common privacy objection to age checks, which is that they create a new store of identity documents. Providers will have to show both that the check works and that the data from it does not linger.

In practice that means a provider needs a record of the method used and the outcome, but not the underlying document or image. Engineering teams should plan for that split early. Logs, vendor retention settings and backups are where “deleted after use” usually fails.

Penalties and the model-destruction remedy

The attorney general can seek civil penalties of up to $25,000 per violation, damages, restitution, other injunctive relief, and the destruction of unlawfully collected data or of AI models trained on it. The attorney general must also run a public website where New Yorkers can file complaints.

Disgorgement of models is not new as a regulatory idea; the FTC has used it in a handful of settlements. Writing it into a state statute aimed at chatbots is a bigger step. A company that trains on conversations with minors in breach of the law could be ordered to give up the model, not just the data. That raises the stakes for training pipelines that use chat logs by default.

When it takes effect

This needs care. The bill text on the New York Senate’s bill page says the act takes effect on the 180th day after it becomes law, which would put the date in late April 2027. The Senate’s record shows the governor signed with an approval memo, which in New York often means agreed chapter amendments will follow, and some reporting gives January 1, 2027 as the start date. The governor’s release says only that the rules apply “in the coming months.” Until a chapter amendment is published, plan for the earlier date.

How New York fits with other states

New York is not alone. Several states have passed chatbot laws, and California’s companion chatbot rules are the most frequent comparison. Policy analysts have described the difference this way: California sets up a child safety governance framework with safety assessments, testing, independent audits and parental controls, while New York relies on a list of prohibited behaviors. New York’s approach is easier to state and arguably harder to apply, because terms like “unprompted emotional questions” are not tightly defined. Our overview of chatbot privacy laws and our comparison of US, EU and UK chatbot rules set out the wider picture.

The law also builds on New York’s own SAFE for Kids Act, which restricts addictive feeds for minors and set the state’s approach to age assurance. At the federal level, COPPA still governs data collected from children under 13, a gap we discussed in COPPA’s growing role, and Congress continues to debate the Kids Online Safety Act. The UK has taken a different route through its Online Safety Act, which we covered in chatbots under the Online Safety Act.

A readiness plan for chatbot providers

Any company that offers a conversational AI feature that New York minors can reach should work through these steps now.

1. Decide whether you are in scope. General assistants, companion apps, customer service bots and in-game characters may all qualify, depending on how the law defines covered chatbots. Get a legal read on each product, not just the flagship one.
2. Map features to the prohibited list. Persona settings, memory, proactive check-ins and romantic role-play modes are the most likely conflicts. Document which ones each product has.
3. Choose an age-gating model. Either verify age and keep features for verified adults, or remove them for all users. Mixed approaches tend to leak.
4. Build deletion into verification. Confirm with any age-assurance vendor that documents and images are not kept, and check your own logs.
5. Review training data. If conversations with possible minors feed model training, stop or segregate them until counsel has reviewed the law’s model-destruction remedy.
6. Prepare for complaints. The attorney general’s complaint portal will generate inquiries. Know who answers them and what records they will need.

Litigation is already moving faster than legislation in this area, as we noted in chatbot litigation trends. Captain Compliance helps teams inventory AI systems, assess their risks and document the controls behind each approval, which is the record a regulator will ask for. That record supports a compliance position; it does not guarantee one.

Frequently asked questions

Does the law ban chatbots for children?

No. It bans specific unsafe features for users under 18. A chatbot without those features can still be offered to minors.

Can a provider rely on users stating their age?

The law requires age verification and more than one method, including one that does not depend solely on government ID. Self-declaration alone is unlikely to meet that standard.

Who enforces it?

The New York attorney general, who can seek penalties of up to $25,000 per violation and other relief, and who must run a complaint website.

What is the effective date?

The passed bill says 180 days after becoming law, which points to late April 2027. Some reports say January 1, 2027. Watch for a chapter amendment that settles it.

Does the law apply to companies outside New York?

It is written to protect New York users, so out-of-state providers whose chatbots are available to New York minors should assume it applies to them.

Hochul said at the signing that she was “not sure why we have to pass a law against something so obvious” as chatbots encouraging suicide. The harder questions will be the less obvious ones: where friendly design ends and an “unprompted emotional question” begins, and whether a regulator will really ask a company to delete a model. The first case under the law will answer both.