New York law will require age checks for many AI chatbot features

The new age-gate requirements

New York is set to implement a significant shift in how people interact with artificial intelligence. Governor Kathy Hochul signed Senate Bill S9051B into law in October 2026, establishing strict rules for AI companion features. The legislation specifically targets systems that deliver ongoing, adaptive responses to users.

While the primary goal of the bill is to protect children, the mechanics of the law create a broader impact. Operators are prohibited from offering covered features to anyone unless they first confirm the user is not a minor. This means every adult user may face an identity checkpoint before they can use certain chatbot functions.

The law officially takes effect on January 1, 2027. Because the confirmation must happen before access is granted, it functions as an adult-gating mechanism for the entire user base. This move marks a transition away from the era of anonymous interaction with generative AI systems.

Defining covered AI features

The statute does not just apply to products marketed specifically as 'companions.' It covers any generative AI system with a natural-language interface that provides adaptive responses. This broad definition means many mainstream assistants might fall under the new regulations if they use specific types of interaction.

Covered features include systems that present themselves as human or emotionally sentient. The law also targets outputs framed as personal opinions or those that use flattery and sycophancy. Additionally, any system that encourages secrecy or facilitates self-harm, drug use, or sexually explicit content is included in the scope.

Technical details of the law also highlight memory as a regulated feature. Systems that draw on information from sessions occurring more than 12 hours earlier are subject to these rules. Because memory and personalized praise are common in many modern assistants, many providers will need to assess their compliance carefully.

Methods for age assurance

To comply with the law, operators must use one of three broad age-assurance categories defined by the attorney general. These methods are designed to verify that a user is an adult without necessarily requiring a government ID for every single interaction. However, the rules require operators to offer at least one alternative to traditional identification.

One method is age estimation, which analyzes physical or behavioral characteristics. This could involve a user providing a selfie, a video, or an audio recording for the system to analyze. A second method is age inference, which uses validated information like an email address or phone number cross-checked against existing records.

The third method is direct age verification, which confirms a user's age through government-issued identification or official records. Regardless of the method chosen, any data collected for these checks must be deleted or de-identified immediately after use. The law strictly prohibits operators from repurposing this sensitive data for any other function.

Privacy risks and enforcement

While the law mandates the deletion of age-related data, privacy advocates remain concerned about the risks of collection. Even with a deletion rule, the initial check can become a gateway to conversations about sensitive topics like mental health or grief. The mere act of collecting identity data creates a potential point of failure for security breaches.

There are also concerns regarding how data might be linked between identity checks and sensitive conversation records. Even if the age data is deleted, the fact that a specific identity was verified to access a specific conversation remains a privacy hurdle. Furthermore, the attorney general has the authority to add new covered features by regulation as technology continues to evolve.

The consequences for non-compliance are significant for AI companies. The attorney general's enforcement powers extend beyond simple fines to the destruction of data and algorithms. This gives the state significant leverage to ensure that operators adhere to the new age-gating requirements starting in 2027.

Exemptions and next steps

Not all AI interactions will be subject to these new identity checkpoints. The statute specifically exempts several types of use cases from the age-assurance requirements. These include customer-service tools, technical systems, and certain internal corporate uses that do not feature companion-like interactions.

For companies providing mainstream AI, the next step involves rigorous testing and certification. Operators must test and certify their chosen age-assurance methods annually and keep documentation for at least 10 years. This creates a long-term administrative burden for developers who want to offer personalized, memory-capable AI features.

The bill was sponsored by Senator Kristen Gonzalez and Assembly Member Alex Bores. As the 2027 deadline approaches, developers will likely begin updating their interfaces to accommodate these checkpoints. Users should prepare for a shift where privacy and anonymity are traded for the ability to use more advanced, personalized AI features.