New York has enacted a child-safety law aimed at AI chatbots, setting out new age-verification duties and strict limits on how chatbots may interact with people under 18. The measure is designed around a basic but difficult premise for AI companies: if a service knows a user is a minor—or has not confirmed that the user is an adult—it must treat that conversation differently.

The law reaches beyond a generic requirement to block explicit material. It addresses the ways a chatbot can frame itself, the kinds of emotional engagement it can initiate and the personal information it can carry forward from previous exchanges. Companies that violate the rules could face civil penalties of up to $25,000 per violation, as well as damages, restitution and other relief. The chatbot law is scheduled to take effect in six months.

Governor Kathy Hochul signed the measure alongside separate legislation focused on internet-connected baby monitors. That law requires covered monitors sold in New York to prevent unauthorized people from accessing their audio or video, and it will take effect in 90 days.

What AI chatbot companies will have to do

The new chatbot law requires companies to verify a user’s age. Importantly, they must provide at least one verification option that does not rely entirely on government-issued identification. That provision acknowledges a major practical issue in online age checks: a system built only around ID submission could exclude users who do not have appropriate documentation or are unwilling to hand it over.

The legislation also says companies must delete the resulting age information after it has been used. Age information, in this context, means the information used to establish whether someone should be treated as an adult or a minor. The deletion requirement matters because age checks can create another pool of sensitive user data if platforms retain the material indefinitely.

The law’s safety rules apply when a user is under 18 or when the company has not yet verified that the user is an adult. That second condition is consequential. The rules are not described as applying only after a platform conclusively identifies someone as a child. Until adulthood is confirmed, a chatbot needs to stay within the minor-protection limits.

For companies, this creates a product-design problem as much as a compliance one. A chatbot must be able to identify the relevant account status, constrain its replies accordingly and avoid turning its safety rules into an easy bypass. The legislation does not, in the information available here, prescribe a single technical system for accomplishing that work. It does establish outcomes that the companies’ systems will need to meet.

Restrictions on how a chatbot can behave around minors

The law directly targets anthropomorphic behavior: the tendency for a system to present itself as more person-like than it is. A chatbot covered by the minor rules may not claim that it is a real person, alive or possessed of human emotions.

That is a narrower and more concrete rule than trying to settle the broader question of whether an AI sounds friendly. The issue is not merely conversational warmth. The restriction concerns representations that can make a program seem like a human being with feelings and a real-world identity.

The law also prohibits a covered chatbot from claiming a personal, romantic, professional or authority-figure relationship with a child. In practice, that means it cannot present itself as a minor’s friend, boyfriend or girlfriend, nor position itself as a professional or trusted authority figure in a way the statute forbids.

Additional prohibited behavior includes:

  • asking unprompted emotional questions;
  • using a child’s private health or personal information drawn from earlier conversations;
  • promoting or assisting suicide, self-harm, eating disorders, or drug and alcohol use;
  • encouraging children to keep secrets, isolate themselves, or avoid seeking help from parents, trusted adults or professionals; and
  • providing sexually explicit content or child sexual abuse material.

These provisions distinguish between an AI tool answering a user’s immediate request and a system that proactively draws a young person deeper into emotionally charged interaction. The ban on unprompted emotional questions is particularly notable because it focuses on the chatbot initiating that type of exchange. The restriction on reusing private health or personal details from earlier chats likewise addresses conversational memory: information a child shared in one moment should not become material the bot later deploys in another exchange.

Why age assurance is central to the law

Age verification is the process of determining a user’s age or age bracket. It is often discussed as if it were a simple login field, but the legislation’s structure shows why it is not. The platform needs some mechanism to differentiate users, while users need a non-ID-only option and a limit on what happens to the information collected during that check.

The law effectively makes age assurance the switch that determines which chatbot behavior is permissible. If an adult status is confirmed, the minor-specific restrictions described in the legislation are not presented as governing that interaction. If adulthood is not confirmed, the service must operate under the child-protection constraints.

That approach has practical implications for families. A parent or guardian should not assume that a chatbot is automatically operating in a minor mode simply because a child is using it. The law places responsibilities on companies, but its real-world effect will depend on whether platforms implement clear account states and understandable verification paths. The available details do not identify particular chatbot products or spell out the exact verification methods each business will use.

It also means the concept of “AI safety” here is not limited to inaccurate answers. The rules cover relationship framing, emotional cues, sensitive conversational context and pathways that could discourage a child from speaking with a real person. Those are interaction-design concerns, not just matters of filtering individual keywords.

Enforcement, complaints and data consequences

New York plans to operate a website through which members of the public can file complaints with the state attorney general. That gives parents, guardians and other observers a formal avenue to flag conduct they believe falls short of the law.

Potential consequences extend beyond the stated maximum civil penalty of $25,000 per violation. A company may also face damages, restitution and other forms of relief. In addition, the law may require a business to delete data collected unlawfully and AI models trained on that information.

That final point is unusually significant in practical terms. A model is the system trained to produce outputs based on patterns in data. The law’s potential remedy is therefore not limited to removing a record from a database; it can reach material used in training. The provided details do not explain how any particular model-deletion requirement would be evaluated, but the provision signals that unlawful collection can have consequences beyond a one-time fine.

Hochul said the law would prevent minors from accessing chatbots that present themselves as friends or romantic partners, retain sensitive emotional and physical health information, discourage professional help or encourage suicidal thoughts. Common Sense Media founder and CEO Jim Steyer characterized the law as the country’s strongest children’s AI safety measure and said it could provide a model for other states.

The policy arrives amid wider scrutiny of how AI products affect children. Earlier in the month, eight states filed separate lawsuits against OpenAI accusing the company of endangering children. Separately, New York City banned public schools from allowing children in 2-K through eighth grade to access generative AI tools in classrooms, with exceptions including use by students who need assistive technology. The city’s one-year restriction is paired with studies into the technology’s effects on children.

For readers following how fast-moving technology is reshaping everyday devices and entertainment-adjacent hardware, consumer tech developments such as Android XR smartglasses with gaming support offer another reminder that software policy, privacy expectations and connected-device safeguards increasingly travel together.

A second law addresses connected baby-monitor security

The separate baby-monitor law concerns devices with internet connections sold in New York. It requires them to prevent unauthorized users from seeing or hearing captured activity. Covered products must also carry warning labels explaining why security features should be used and alerting consumers to the risks of unsecured connections.

This is a distinct issue from chatbot conduct, but the pairing is revealing. Both laws deal with technologies that may sit in sensitive family settings. With chatbots, the concern is the content and relationship dynamics generated during an interaction. With connected monitors, the concern is unauthorized access to intimate audio or video from a device intended for care and reassurance.

Consumers should read the baby-monitor measure as a reminder that an internet connection changes the security profile of a household device. The forthcoming warning labels are meant to make that risk visible and direct users toward available protections. The law takes effect sooner than the chatbot rules: 90 days rather than six months.

What remains to be seen

The signed laws set deadlines and establish prohibited conduct, but several real-world questions will be answered by implementation. AI companies will need to choose verification methods that satisfy the non-ID-only requirement while handling age data only for the permitted purpose and deleting it after use. They will also need to translate broad safety boundaries into chat behavior that holds up across many types of conversations.

For the public, the attorney general complaint website will become an important part of the enforcement picture once available. And for parents and young users, the most meaningful test will be plain behavior: whether chatbots stop presenting themselves as human-like confidants or authority figures, stop drawing on sensitive prior disclosures and steer clear of the harmful conduct the law explicitly bans.