New York law will require age checks for many AI chatbot features

The new age-gate requirements

New York Governor Kathy Hochul signed Senate Bill S9051B into law in October 2026. The legislation requires operators of generative AI systems to confirm that a user is not a minor before allowing them to access specific chatbot features. This mandate is set to take effect on January 1, 2027.

Because the law requires confirmation before any access is granted, it functions as a universal age-gate. This means that even adults will likely face an identity checkpoint rather than just children being blocked from the service. The bill passed the state Senate with a 60–0 vote, signaling a clear legislative intent to regulate AI interactions.

The law specifically targets systems that use natural-language interfaces to provide ongoing and adaptive responses. It does not just apply to products marketed as companions, but to any system that mimics human-like behavior. This broad scope means many mainstream AI tools may need to adjust their compliance strategies to meet the new state requirements.

Defining covered AI features

The statute identifies several specific behaviors that trigger the age-verification requirement. These include systems that present themselves as human or emotionally sentient, or those that frame their outputs as personal opinions. It also covers AI that uses flattery or sycophancy to engage with the user.

The law further includes technical capabilities like memory and personalization. For example, a chatbot that draws on information from sessions held more than 12 hours earlier is covered. It also targets systems that encourage secrecy or facilitate content involving self-harm, drug use, eating disorders, or sexually explicit material.

Many popular AI assistants already use emotional language and personalized praise as standard features. Because of this, providers may have to assess their compliance even if their primary product is not a companion app. However, the law provides some relief by exempting customer-service tools, research systems, and certain internal corporate uses.

Methods of age assurance

To comply with the law, operators must offer at least one alternative to government-issued identification. New York's SAFE for Kids rules outline three broad categories for this verification. These methods allow companies to choose how they balance user privacy with the state's safety requirements.

The first method is age estimation, which analyzes physical or behavioral characteristics. This could involve the AI analyzing a user's selfie, a video, or an audio recording to guess their age. The second method is age inference, which uses validated data like an email address or phone number cross-checked against existing records.

The third method is direct age verification, which requires a government-issued ID or an official records source. Regardless of the method chosen, any data collected for this purpose must be deleted or de-identified immediately. Operators are also required to test and certify their chosen methods annually and keep documentation for at least 10 years.

Privacy and enforcement risks

While the law mandates the immediate deletion of age data, privacy advocates remain concerned about the collection process itself. The verification step creates a new point of entry for data regarding sensitive topics like mental health or personal relationships. There is a lingering risk of security breaches or false classifications during the check.

The attorney general has significant power to enforce these rules and can impose substantial penalties. Beyond simple fines, the agency has the authority to order the destruction of data and the underlying algorithms. This creates a high-stakes environment for companies trying to navigate the new legal landscape in New York.

Furthermore, the attorney general can add new covered features to the law through regulation as technology continues to advance. This means that the target for compliance could shift over time. Operators will need to stay updated on how the state defines new AI behaviors as they emerge in the marketplace.