New York signs S.9051B, banning unsafe AI chatbot features for minors

New York Governor Kathy Hochul signed two bills on October 28, 2026, one banning unsafe AI chatbot features for minors and the other setting new safety requirements for internet-connected baby monitors sold in the state.

The chatbot measure, S.9051B/A.10379C, bans AI chatbots from pretending to be human, encouraging self-harm or engaging minors in sexually explicit conversations, while the baby-monitor measure, S.9508/A.5175A, requires security features and warning labels on devices sold in New York.

What it is

The chatbot bill started as S9051, which the New York State Senate Committee on Internet & Technology, chaired by State Senator Kristen Gonzalez, passed as part of a broader technology legislation package.

New York's law is one of 14 chatbot protection laws enacted by state legislators over the past year, according to the Transparency Coalition.

The chatbot law takes effect on January 1, 2027, leaving covered companies a short compliance window.

The baby-monitor law will take effect 90 days after signing.

What it requires

The law prohibits companies that utilize AI chatbot features from offering unsafe features to minors, including chatbots that pretend to be human, build emotional dependency, encourage self-harm or engage in sexually explicit conversations.

It requires companies to conduct age verification and offer more than one way to verify age, including at least one option that does not depend solely on a government ID.

It also requires that age information be deleted after it is used.

Violations would allow the attorney general to seek civil penalties of up to $25,000 per violation along with damages, restitution, the destruction of unlawfully collected data or any AI models trained on it, and any other appropriate injunctive relief.

The law also requires the attorney general to maintain a public website where New Yorkers can file complaints.

The companion baby-monitor law requires internet-connected baby monitors sold in New York to include security features that block strangers from watching or listening in, along with a clear warning label.

What security leaders should do

Security and privacy teams at any company operating a chatbot, companion app, or embedded virtual assistant reachable by New York minors should inventory where age-gating, conversation logging, and self-harm detection sit in the product today, since the statute reaches any AI chatbot feature rather than only dedicated companion apps. Confirm that age-verification flows include at least one method that does not rely on government identification, and that age data is deleted once verification completes, matching the statute's stated requirement. Legal and compliance teams should map conversational behaviors such as impersonating a human, retaining a minor's health details, or discouraging a user from seeking help, since these fall inside the prohibited categories carrying per-violation penalties. Given the January 2027 effective date, product and security teams have a short window to redesign or retire features that fall into these prohibited categories and to build the logging needed to respond to attorney general complaints. Teams with connected-device product lines sold into New York should separately review whether their offerings meet the baby-monitor law's security and labeling requirements ahead of its own effective date.