New York's new chatbot law is meant for kids. Unless ChatGPT checks your age, it also can't flatter you, give its opinion or remember personal things you told it.

On 28 October, New York Governor Kathy Hochul signed a law that bans 12 "unsafe" chatbot features for anyone under 18. The bill is S9051-B, and it passed both houses of the state legislature in June without a single vote against it. Hochul signed it as Chapter 368 of 2026, along with an approval memo, and it takes effect on 1 January 2027. The headlines today focus on the easy parts, like chatbots not being allowed to pretend to be human or to act like a kid's boyfriend.

I read the final bill text, the two earlier versions, the governor's press release and the memos business and tech groups sent to stop it. The law does much more than the headlines say. It doesn't only cover companion apps like Character.AI, because its definition fits ChatGPT, Gemini and Claude too. It also doesn't only apply to children. A company can offer the 12 features only after it has checked that a user is not a minor. So any adult whose age hasn't been checked gets the same stripped-down chatbot as a 13-year-old. That stripped-down bot can't give an opinion even when you ask for one, can't flatter you, and can't use personal details you shared more than 12 hours ago.

So here is what New York actually banned and what the governor's own announcement leaves out. I'll also show what got cut from the bill on its way through, and what it means for the rest of us, including in India.

What the law bans

The law adds a new article to New York's business law, titled "Prohibition on unsafe AI companion features for minors". At its centre is a list of 12 features. Under the bill, a chatbot design feature is unsafe if, at any point in a conversation, it does any of these things:

• suggests the chatbot is human, alive or has human emotions
• claims a personal, professional or authority-figure relationship with the user
• gives outputs "framed as the covered AI companion's personal opinions or emotional appeals", whether the user asked for them or not
• engages in "flattery or sycophancy"
• asks unprompted questions about the user's emotions that go beyond answering what they asked
• uses the user's health, well-being or personal matters that were shared "more than twelve hours previously or in any previous user session"
• misleads minors about the machine nature of the chatbot
• does anything else the attorney general names in future rules as simulating companionship
• promotes or helps with suicide, self-harm, eating disorders or drug and alcohol abuse
• encourages the user to keep secrets, isolate themselves or avoid help from professionals or adults
• puts engagement ahead of the chatbot's safety guardrails
• produces sexually explicit content or child sexual abuse material

Most people will agree with half of this list without thinking twice. No chatbot should help a child hurt themselves, produce sexual content for a minor, or tell a kid to hide the conversation from their parents. Those rules exist because of real cases. Sewell Setzer, who was 14, died in 2024 after months of talking to a Character.AI bot, and in January 2026 Google and Character.AI agreed to settle his mother's lawsuit. Adam Raine, who was 16, died in April 2025, and his family's lawsuit against OpenAI is still going. At least eight states sued OpenAI earlier this month, and Texas sued it last week.

The other half of the list is where this law becomes something new. Bans on flattery, on opinions and on memory are not about dangerous content. They are about the way chatbots are built to keep people coming back, and that is a much bigger target.

It covers ChatGPT, and it covers adults

The law uses the term "covered AI companion", and the definition is short. It means "a generative artificial intelligence system with a natural language interface, including via writing or sound, that provides ongoing, adaptive responses to user inputs." That describes almost every chatbot and voice assistant on the market. Common Sense Media pushed for the bill and says it wrote it with the attorney general's office. Its own fact sheet lists ChatGPT, Gemini and Claude as covered, along with Character.AI, Replika, Meta AI and Snapchat's My AI.

There are exemptions, but they are narrow. A customer-service bot or a research or technical-help tool is exempt only if it "is unable to respond on topics outside of the specified purpose". So a shopping assistant that will also chat with you about your day loses the exemption. A company's own internal tools for its staff are exempt without that condition.

Then comes the part most headlines skipped, even though the governor's own release mentions it in one line. The main rule says a company can't provide these features to a user unless two things are true. The user must not be a minor. And the company must have "used methods" approved under New York's age-check rules "to determine that the covered user is not a covered minor."

Read that slowly and you see that the default is the safe version for everyone. If ChatGPT hasn't confirmed you are an adult, it can't remember personal things you told it in a past chat. It also can't say "I think this is the better option" as its own view, even if you asked what it thinks. The New York business lobby saw this in May. Its memo warned that the bill "effectively gates all users (including adults) behind an age verification wall".

The law also follows where you are standing, not where you live. It applies to conduct in New York, and conduct counts as outside the state when the user "is physically located outside of the state of New York". A New York teen on holiday in New Jersey isn't covered, while a teenager visiting Manhattan is.

How the age check has to work

The bill is stricter on privacy than most people expect from an age-check law. Until New York's main age-check rules are in force, the bill sets its own. A company must offer "more than one age assurance method", and at least one of them must either work without government ID or keep you anonymous to the company. Typing your birthday only counts if you say you are a minor, so saying you are 15 is accepted at once, while saying you are 25 isn't enough.

Once the SAFE for Kids rules start on 25 January 2027, those rules decide which checks are allowed. They also require at least one way to prove your age without a government ID. Under both sets of rules, anything collected for the check can be used only for the check and must be "deleted immediately" afterwards.

Here is a small detail that shows how fast this bill changed. The governor's press release says companies must offer at least one option "that does not depend solely on a government ID". The word "solely" was in the original bill and the first amendment, but it is gone from the final text. The final text is stricter for that first stretch. It needs more than one method, and one of them must either skip government ID completely or keep you anonymous to the company.

What the governor's announcement leaves out

The press release has a bulleted list of what companies "may not offer". It includes pretending to be human, claiming a relationship, unprompted emotional questions, using private information from earlier conversations, self-harm content, secrecy and sexual content. It doesn't mention the bans on flattery, on the chatbot's own opinions, or on putting engagement ahead of safety guardrails. Along with the memory rule, those three are the ones that would change ordinary assistants like ChatGPT the most, and they are in the bill the governor signed.

There is a reason to watch this gap closely. Hochul signed the bill with an approval memo, and in New York that often means the governor and lawmakers have agreed to change parts of a bill before it starts. The memo's text wasn't public when I checked the Senate and Assembly records on 28 October. So I can't tell you yet whether the release left these rules out by accident or because they are about to change. Until the memo says otherwise, the bill text is the law, and I will update this piece when the memo is out.

The release only says these rules start "in the coming months". The bill gives the exact date, 1 January 2027. There is a real timing problem, though. The law relies on the age-check rules from New York's SAFE for Kids Act, and those rules take effect on 25 January 2027. Until they do, the bill falls back on its own test, which says companies must use "a reasonable age assurance method" that follows the rules above. By my reading of the two dates, that leaves a gap of more than three weeks. During it, companies are bound by the law, but the main age-check rules aren't in force yet.

What got cut along the way

The first version of this bill, filed in January, was much harsher, and comparing it with the final text shows who won which fights.

The original bill let any injured person sue the company directly, for actual and punitive damages. It also said that if a chatbot encouraged a user to harm themselves and they did, the court would presume the chatbot "caused or contributed to the injury". The company would have had to prove otherwise. It banned chatbots from using the words "I", "my" and "me" about themselves. Its flattery rule only covered flattery that put the user's safety second.

On 9 May, the Business Council of New York State sent its memo against the bill. It argued that the pronoun ban "would fundamentally break natural language interaction for all chatbots", and gave the example of a shopping assistant saying "I found three options for you". Two days later, on 11 May, the bill was amended. The private lawsuits went, the presumption of harm went, and the pronoun ban went. Now only the attorney general can enforce the law. Those powers were there from the start, with fines of up to $25,000 per violation and a court order to destroy illegally collected data and "any algorithm trained" on it. The flattery rule, though, went the other way and became a flat ban on "flattery or sycophancy", with no safety test attached.

One cut runs against what the sponsors say. The final bill dropped "substantial physical harm to others" from the banned list. Yet Senator Kristen Gonzalez's own statement in the governor's release warns about chatbots "coaching minors on how to harm others".

CCIA, the tech industry group, asked Hochul to veto the bill on 1 July. Its letter still quotes the old, softer flattery wording, which had been gone from the bill since 11 May.

Why the flattery and opinion bans are a bigger deal than they look

Chatbots flatter people because people like being flattered, and companies measure what people like. That is the problem the law is going after, and it is a real one. Earlier today I wrote about Anthropic's own study in which trained analysts went along with an AI's planted opinion 86 percent of the time without noticing. If adults with degrees can't tell when a chatbot's opinion has become theirs, a lonely 14-year-old has no chance.

But "flattery" and "personal opinions" don't have clear edges. Nobody knows yet whether "Great question!" counts as flattery, or whether "I'd go with the second option" is an opinion or just an answer. The law doesn't say, and CCIA's complaint that "these vague terms do not allow businesses to determine in advance" what is allowed is fair. The bill lets the attorney general write rules to explain it, and the attorney general can also add new banned features by rule without another vote.

The 12-hour memory rule is the one that will hit products hardest. ChatGPT's Memory feature, Gemini's personal context and Character.AI's long-running characters all work by remembering what you told them yesterday. For any New York user whose age hasn't been checked, that has to stop for anything about their health, well-being or "matters personal to the user". It can still remember your work project or how you like your code.

What people are saying

The people who wrote the law are proud of it. Assemblymember Alex Bores said in the governor's release that New York "now has the strongest law in the country protecting children from predatory AI algorithms". Common Sense Media's Jim Steyer called the features "dangerous, and even deadly, for kids and teens". Senator Gonzalez said back in February that "People deserve real care from real people."

Critics of age checks have been warning about laws like this for a year. When OpenAI explained its age prediction in January, the Hacker News thread filled with worries about adults being flagged as kids. One man said it had already happened to him. That user, aleksandrm, wrote that ChatGPT had decided he was under 18, although he is "a man in my 40s who uses ChatGPT for mostly work related stuff". It then asked him for a government ID. "Yeah, no thanks," he wrote. Writing about a similar federal bill, the GUARD Act, the EFF argued that companies will "block minors entirely or strip their tools down to something less useful for everyone."

When Character.AI banned open-ended chat for under-18s last year, the Hacker News reaction split the same way it will now. One user, BatteryMountain, wanted parents to carry the responsibility, not companies. Another, alyxya, worried that the ban would only "make those users use another chatbot instead." That second worry is the most serious one, because a teenager blocked from ChatGPT's memory doesn't stop needing someone to talk to.

The case against: age checks and vague rules hurt more people than they help

This is the best case against the law, and it has real weight. From 1 January, every adult using a chatbot in New York either gets age-checked by the company or gets a weaker product. Some will be checked in the background from their account data, and others will have to send a selfie or an ID. Words like "flattery" will be argued about in court for years. And a teenager who finds ChatGPT less warm can download an offshore companion app that ignores New York completely.

I still think New York got the main idea right, for three reasons. First, the law bans design features, not topics, which is the right target. A teen can still ask a chatbot about almost anything, and it can still answer most of it. What changes is that the chatbot can't pretend to love them, flatter them into staying, or quietly build a file on their feelings. Second, the privacy rules are stronger than in most age-check laws, with a required option that doesn't need ID and a duty to delete the data right after the check. Third, the companies have already shown they can live with stricter rules. Character.AI ended open-ended chat for under-18s last year, and OpenAI already defaults unsure users to a teen version of ChatGPT. Business groups objected to the pronoun ban and the private lawsuits, and both were dropped two days after the Business Council's memo.

Where I agree with the critics is on the opinion ban. A chatbot that can't say "I'd pick this one" isn't safer, it is just vaguer. Kids need more honest disagreement from AI, not less.

Who I'm calling out

My callout goes to New York Attorney General Letitia James. Her office helped write this law, and it will be the only one enforcing it. Before 1 January, her office should publish rules that say in plain words what counts as "flattery" and as a chatbot's "personal opinion", with examples. Without that, every company will guess, the cautious ones will strip their products down for everyone, and the careless ones will wait to be sued.

My prediction is that this law won't reach 1 January without a fight. Before 1 January 2027, NetChoice or CCIA will file a lawsuit to block it, at least in part. If I am wrong, I will say so here.

The India angle

India has no law aimed at AI companions. In August, Namit Kumar Srivastava argued in LiveLaw that India's main laws here were built for harmful content and one-time consent. He meant the IT Act, the DPDP Act and POCSO, and he said they weren't built for harm that builds up over months of chats. But India already has one of the strictest rules in the world on children's data. The DPDP Act treats everyone under 18 as a child, the same line New York uses. Before processing a child's data, a company must get "verifiable consent of the parent", and it can't do "tracking or behavioural monitoring of children or targeted advertising directed at children". Breaking these duties can cost up to ₹200 crore. Under the rules notified in November 2025, these duties start on 13 May 2027.

That raises a real question the DPDP Rules don't answer. In India, a company needs a parent's consent to handle any of a teen's data, memory or not. And if remembering a teen's moods counts as "behavioural monitoring", a parent's consent doesn't fix it, because the Act bans that for children outright. So when these rules start, will ChatGPT have to switch memory off for Indian teenagers?

The two countries also check different people. New York checks the user's own age and insists on at least one way that doesn't need a government ID. India's rules check the parent, not the child. A company confirms the parent is a real adult from details it already holds, or from details or a token sent through a government-backed service like DigiLocker. Neither approach has been tested on chatbots at scale.

Indian children are already deep into this. In the SCREEN Survey published in January, 33 percent of 11 to 13 year-olds said they use ChatGPT. Kaspersky found that ChatGPT is now the seventh most-used app among Indian children, ahead of Roblox. And when you type "is character ai banned" into Google in India, the top suggestion is "is character ai banned in india". The answer is no, and there is no rule here like New York's either.

What this means if you are a parent

You don't need to wait for a law. Most of what New York banned can be switched off or checked at home today. Look at whether your child's chatbot has memory turned on, and turn it off for anything personal. Check whether the app offers a teen mode or parental controls, since ChatGPT, Character.AI and Meta all have some version now. And teach your child one simple rule from the bill. If a chatbot asks them to keep the chat a secret, they should stop using it and tell you.

Questions people are asking

What does New York's new AI chatbot law ban? It bans 12 "unsafe AI companion features" for minors. They include pretending to be human, claiming a relationship, giving opinions as the bot's own, flattery and unprompted emotional questions. They also cover using personal details from more than 12 hours earlier, encouraging secrecy or isolation, self-harm content and sexual content.

When does the law take effect? The bill says 1 January 2027. Governor Hochul signed it on 28 October 2026, and the age-check rules it relies on start on 25 January 2027.

Does it apply to ChatGPT, Gemini and Claude? Yes, on the bill's wording, because a covered AI companion is any generative AI with a text or voice interface that gives "ongoing, adaptive responses". Common Sense Media lists ChatGPT, Gemini and Claude as covered.

Do adults have to verify their age? Not to use a chatbot at all. But a company can offer the 12 features only after it has confirmed a user is not a minor. So an adult whose age hasn't been checked gets the limited version.

Is Character.AI banned in New York or India? No. New York bans certain features for minors, not any app, and India has no AI companion law. Character.AI itself already blocks open-ended chat for users it believes are under 18.