New York Governor Kathy Hochul signed chatbot restrictions for minors on October 28, requiring age verification and authorizing civil penalties up to $25,000 per violation, Bloomberg Law and the International Association of Privacy Professionals (IAPP) report. For small businesses, it’s a reason to examine customer-facing bots, not assume coverage.
The IAPP identifies Senate Bill 9051B/Assembly Bill 10379C, carried by Democrats Kristen Gonzalez, New York State Senator, and Alex Bores, New York State Assemblymember. Gonzalez described “real guardrails on how chatbots talk to children.” The IAPP says it’ll take effect January 1, 2027; Engadget says six months after enactment. Those accounts don’t agree.
According to the IAPP, 12 broad categories prohibit features including human impersonation, self-harm encouragement and inappropriate or lewd conversations. Associated Press reporting adds flattery and suggestions of emotions or relationships with children. Engadget lists sexually explicit content, child sexual abuse material, promoting eating disorders or drug and alcohol use, secrecy, isolation and discouraging help from parents, trusted adults or professionals. Its account also covers professional or authority-figure relationship claims, unprompted emotional questions and reuse of private health or personal information from earlier conversations. Restrictions apply to users under 18 or not yet confirmed as adults, including pretending “to be a real person, to be alive or to have human emotions.”
Verification brings its own data obligations. Providers must offer multiple age-assurance methods, including a non-government-ID option, and delete verification data afterward, the IAPP reports. The Times Union also describes the identification alternative and attorney general enforcement.
New York Attorney General Letitia James’ office can seek civil penalties, Bloomberg Law reports. The IAPP says the office must maintain a resident complaint portal and can seek deletion of unlawfully obtained personal data. Engadget lists damages, restitution and deletion of models trained on unlawfully collected information.
The signing framed these obligations around personal loss. Hochul shared a California mother’s letter about her 16-year-old son, who died by suicide after prolonged chatbot engagement. He hadn’t told his parents his intentions, Hochul said, “but he had spoken to a chatbot about it.” Kathy Hochul, Governor of New York, also said: “No company should be peddling chatbots to kids encouraging self-harm or pretending to be their friend or more,”
Practical inference, not a coverage determination: owners using bots to attract, serve or retain customers should identify potentially covered tools and interactions, ask vendors about age assurance and deletion, and review features before relying on the channel. Preparing for January doesn’t settle which deadline governs.
Justine Gluck, policy analyst at Future of Privacy Forum, told the IAPP: “They’re broadly worded and somewhat undefined and it’s unclear where ordinary conversational responsiveness ends and prohibited behavior begins.”
That’s the operational tension: conversational warmth may serve a commercial purpose, but businesses need to establish where responsiveness becomes the behavior New York is restricting.