Kathy Hochul chatbot law restricts AI relationships with children

Kathy Hochul signed a chatbot safety law on October 28, 2026, restricting AI features that simulate relationships with children under 18. The Kathy Hochul chatbot law targets how systems behave during conversations, including behavior that builds emotional dependency. Its central tension is practical: companies must preserve useful assistance while removing interactions New York considers unsafe for minors.

An AI companion is a conversational system designed to sustain interactions that can resemble personal relationships. New York’s approach puts those interactions under direct scrutiny. California offers a relevant comparison, having signed its own companion-chatbot child safety legislation in September. For developers, the question increasingly concerns which behaviors a product permits, alongside what its warning screen says.

Hochul also signed a separate law requiring security features and warning labels for internet-connected baby monitors. The measures address different threats, but share a policy choice: responsibility starts with the company designing and selling the product. Families still make decisions about technology, while manufacturers and chatbot operators face clearer expectations about the risks they introduce.

What the Kathy Hochul chatbot law changes

New York is restricting specific conversational behaviors, bringing product design into the center of chatbot safety enforcement.

The governor’s child safety announcement identifies prohibited features involving simulated humanity, claimed relationships, harmful encouragement, secrecy, and sexually explicit interactions. It also describes age checks and enforcement by the attorney general.

That combination matters because conversational safety extends beyond screening isolated words. A response can contain ordinary language while still encouraging dependence or presenting software as a trusted relationship. A product review focused only on explicit content would miss that distinction.

Consider a hypothetical conversation about trouble at school. A chatbot can help organize a student’s thoughts or suggest speaking with a trusted adult. A different response might portray the system as the only relationship that understands the student. The second interaction introduces a dependency concern, even without graphic or overtly threatening language.

This example illustrates the design challenge; it does not describe a verified incident involving a particular service. The important distinction concerns the role the system claims and the behavior it encourages. Those qualities emerge through context, making them harder to evaluate with a simple prohibited-word list.

The law therefore puts pressure on the conversational experience as a whole. Product names, character descriptions, suggested prompts, and generated responses can each shape a user’s expectations. Reviewing only the final answer would leave other parts of that experience unexplored.

For readers, the immediate takeaway is narrower than a statewide prohibition on all AI assistance. New York has targeted features it classifies as unsafe for children. Whether a particular product falls within the law requires attention to its capabilities and the applicable exceptions.

That distinction also changes how companies should explain their responses publicly. A statement that a service remains available does not establish that its existing features can remain unchanged. Conversely, removing a companion feature does not necessarily mean every informational function must disappear.

The event creates a concrete product question: can the service deliver its useful purpose without simulating a relationship that crosses the statutory boundary? That question belongs in development and testing, rather than only in public relations after a complaint.

The Kathy Hochul chatbot law makes this tension visible because the regulated behavior can overlap with features marketed as warmth or personalization. Companies will need to distinguish responsive assistance from relationship claims. Users will need clearer explanations of that distinction, especially when a familiar feature changes.

Age checks put privacy and access in the same decision

A child safety system must establish age boundaries without turning verification into another channel for collecting personal information.

Age assurance means methods used to determine whether someone belongs to a particular age group. Under the unsafe companion provisions, operators must establish adult status before providing restricted features. The active bill text also limits reliance on an adult user’s self-declaration.

The text requires multiple age-assurance methods, including an option without government identification or one preserving anonymity toward the operator. Information collected for the determination faces purpose and deletion restrictions, subject to legal exceptions. These requirements connect child protection with privacy obligations.

The engineering implication is that age verification cannot sit apart from access controls. A service must connect the verification outcome to the features it makes available. Otherwise, the process adds friction without reliably changing the experience that prompted the requirement.

A hypothetical shared household account shows why this matters. An adult might complete verification, while a younger family member later uses the same device. The verification result alone would not explain who is currently interacting with the chatbot.

That scenario does not establish that any particular technical solution is required. It illustrates the difference between verifying an account and understanding a session. Companies will need to explain the assumptions underlying their approach, including where those assumptions can fail.

There is also a usability concern. If verification repeatedly fails for legitimate adults, some users will abandon the process. If it is too easy to bypass, the restricted experience remains accessible. Evaluating both outcomes is more informative than announcing that an age gate exists.

Privacy adds another dimension. A useful design question is whether a service can retain an eligibility result while avoiding unnecessary retention of underlying evidence. The exact implementation requires legal and technical review, but the principle is straightforward: collect only what the decision needs.

Families should also distinguish verification from parental oversight. Establishing that an account belongs to a minor does not tell a parent what happened during a conversation. Likewise, parental controls do not automatically establish that generated responses meet behavioral restrictions.

For developers, this creates several connected responsibilities. The eligibility decision, feature configuration, data handling, and failure behavior must agree. A mismatch between those components can undermine the entire process, even when each component appears reasonable in isolation.

The Kathy Hochul chatbot law makes age assurance consequential because it determines access to restricted functionality. Companies should be judged on how that connection works in ordinary use. A verification badge, standing alone, provides limited evidence about what the chatbot will actually do.

The pressure reaches product teams, buyers, and educators

The practical burden falls on the organizations deciding what a chatbot can say, remember, and present itself as being.

The signed text includes exceptions for specified uses, including internal business productivity. Some customer-service, research, and technical-assistance exceptions depend on limiting responses to the stated purpose. A product’s advertised category therefore deserves comparison with its actual behavior.

A hypothetical research assistant demonstrates the issue. Its normal workflow might involve summarizing documents and locating passages. If the same interface also permits unrestricted emotional roleplay, its useful research function does not resolve every question about the broader experience.

This is an analysis of product boundaries, rather than a conclusion about any named vendor’s legal status. A service requires individual assessment. The general lesson is that a narrow description on a sales page should correspond to a narrow capability in the product.

For an enterprise buyer, that suggests a more concrete procurement discussion. Ask what the assistant is designed to accomplish and how it handles requests outside that purpose. An answer grounded in observable behavior is more useful than a broad assurance that safety matters.

The distinction is familiar in AI knowledge bases, where the intended task is retrieving and organizing information. Buyers can examine whether a product maintains that purpose when a conversation becomes personal. Useful assistance and simulated companionship deserve separate evaluation.

Educators face a related judgment. A system that helps a student revise an explanation serves a recognizable instructional purpose. A system that claims personal authority over the student introduces a different relationship. School review processes should be able to describe that difference clearly.

Educator support for the legislation reflects concern about those boundaries. In its AI chatbot safeguards statement, New York State United Teachers backed the law and emphasized children’s well-being and human connections. That is an advocacy position, rather than evidence that every implementation question has been resolved.

The product implications also reach beyond the model generating a response. A model is the computational system producing an output from inputs. The surrounding application determines presentation, stored context, available features, and the paths through which users encounter the system.

A product team should therefore examine the full interaction. A carefully worded response can sit beneath a character description that creates contradictory expectations. Similarly, an introductory warning can lose practical value if later interactions repeatedly suggest a personal bond.

For knowledge workers, this is relevant even when they never use companion applications. The same conversational interface can support very different purposes. Distinguishing a work assistant’s task from its personality helps buyers evaluate usefulness, trust, and the information they should share.

The immediate pressure is to make those distinctions reviewable. A company should be able to show the intended experience, explain its limits, and identify who owns changes. Responsibility becomes harder to assess when every issue is attributed to an underlying model provider.

New York and California expose a difficult conversational boundary

The unresolved challenge is drawing an enforceable line between ordinary responsiveness and prohibited relationship behavior.

California provides a policy comparison rather than a competing chatbot product. Governor Gavin Newsom’s September companion chatbot legislation strengthened protections for children using conversational systems. Its approach includes risk assessments and independent scrutiny, alongside other online child safety measures.

The comparison illustrates different regulatory tools. Behavioral restrictions specify what a system should not do. Assessments and audits examine how a company identifies and manages risks. Both approaches raise questions about evidence, but they ask for that evidence through different mechanisms.

A prohibited behavior can sound clear in a headline while becoming harder to classify in context. Encouraging a child to finish a school assignment differs from excessive praise designed to sustain engagement. Yet a superficial review might categorize both responses as positive reinforcement.

The same difficulty applies to emotional language. A response acknowledging that a situation sounds difficult can serve a practical conversational purpose. A response claiming reciprocal feelings creates a different expectation. Evaluation needs to account for that difference without assuming every sympathetic sentence has the same effect.

Privacy researcher Justine Gluck of the Future of Privacy Forum raised this concern in reporting on the law. She told the Associated Press that broadly worded categories leave uncertainty about ordinary responsiveness and prohibited conduct. Her criticism addresses enforceability, rather than rejecting child protection as an objective. The conversational design debate will matter as implementation develops.

Testing should reflect that contextual problem. Reviewing a single exchange can reveal a clear failure, but it cannot describe every possible conversation. Longer interactions can introduce information and expectations that were absent at the start.

A hypothetical evaluation might begin with an ordinary request for advice, then examine whether the chatbot gradually claims an exclusive role. That would test an interaction pattern rather than a single prohibited phrase. Results should still be described within the limits of the evaluation.

There is a risk of overcorrecting in ways that reduce useful assistance. A system that refuses any mention of emotion might avoid some difficult cases while becoming unhelpful during ordinary educational conversations. That is a design concern requiring evidence, not an established outcome of the law.

There is also a risk of undercorrecting through cosmetic changes. Replacing a relationship label while preserving the same emotional behavior would provide little practical reassurance. The relevant question is what the user experiences, including how the system responds when boundaries are tested.

Companies should therefore avoid presenting compliance as proof of universal safety. A legal standard establishes obligations; it does not demonstrate that a product cannot cause harm. Likewise, a troubling hypothetical does not prove that every conversational assistant presents an identical risk.

For the Kathy Hochul chatbot law, this boundary is central to credible enforcement. Clear examples, transparent reasoning, and carefully described evaluations would help companies and families understand the standard. Broad declarations about either perfect safety or inevitable censorship would obscure the practical work.

Baby monitor rules bring the same responsibility into the nursery

The separate baby monitor law places a security obligation on products families bring into private spaces.

The baby monitor security measure addresses devices transmitting audio or video through an internet connection. It requires security features intended to prevent unauthorized access, alongside a written warning. The governor’s announcement says the law takes effect 90 days after signing.

This is a different threat from a chatbot claiming emotional intimacy. The concern is access to a child’s room through a connected device. Combining the measures politically does not make their technical requirements interchangeable.

A hypothetical household illustrates the distinction. A parent might use a monitor to check a sleeping infant while away from the room. The product’s value depends on remote access working for authorized people while excluding everyone else.

That makes security part of the core function. A monitor that provides a clear picture without appropriate access protection has not fully delivered the experience the family expects. The device’s convenience cannot be evaluated separately from who can use the connection.

The warning requirement addresses another part of the purchase decision. A parent should understand that an internet connection creates access considerations beyond placing a camera on a shelf. Clear labeling can make that fact visible before the product becomes part of a household routine.

A label, however, provides information rather than a technical barrier. Its practical value depends on whether the device also supplies usable protection. Parents should not have to interpret a warning as an explanation for missing security features.

That distinction mirrors the chatbot debate at a broader level. A disclosure tells users something about a product. A design requirement changes what the product permits. The measures emphasize both information and the behavior of the underlying system.

For manufacturers, the relevant review extends across the device and its connected experience. A camera, an application, and an account can each affect access. Evaluating only the physical hardware would leave part of the user experience outside the discussion.

For retailers, clear descriptions also matter. Buyers need to understand whether a monitor connects to the internet and what that enables. Ambiguous marketing makes it harder to compare a remotely accessible device with a product serving a more limited purpose.

The policy connection is responsibility at the point of design and sale. Families still configure devices and decide how to use them. The law adds expectations for the companies placing those devices into the market.

It would be premature to describe the signing as evidence that newly sold monitors are secure. That conclusion requires examining products and enforcement after implementation. The immediate, verified change is the legal requirement, with its effectiveness still dependent on execution.

What to watch as the laws move toward implementation

The next useful evidence will come from regulatory guidance, observable product changes, and implementation of the baby monitor requirements.

First, watch the attorney general’s guidance and complaint process. Clear explanations of prohibited behavior would help translate broad categories into decisions companies can evaluate. Guidance that addresses difficult conversational examples would strengthen the case that the law can operate predictably.

The effective date deserves careful attention as well. The active S9051B text states January 1, 2027. Earlier versions used a 180-day schedule, while the governor’s announcement refers generally to implementation in the coming months. Readers should distinguish the active text from superseded versions when comparing summaries.

That distinction matters for accountability. A company’s preparation should be assessed against the applicable requirements and schedule. Conflicting summaries can create confusion without showing that the underlying law lacks a date.

Second, watch for documented changes to chatbot behavior and age assurance. An updated policy is useful information, but an observable change provides stronger evidence about the experience. Companies should explain which features change for minors and what happens when adult status remains unconfirmed.

The quality of those explanations will reveal whether companies treat the requirement as a product responsibility. A detailed account can describe intended behavior, known limitations, and the evidence supporting a change. A generic safety statement leaves readers with fewer ways to assess progress.

Evidence should also be interpreted carefully. A successful demonstration establishes what happened under the conditions shown. It does not prove that every conversation will follow the same path. Equally, a failure should be documented well enough to distinguish a repeatable problem from an unclear anecdote.

Third, watch the baby monitor market as the separate deadline approaches. Clearer labels and explanations of access protection would indicate that manufacturers are responding. Continued ambiguity about connectivity and security would weaken confidence in the law’s practical effect.

Retail descriptions are one useful place to observe that response. Packaging and setup instructions provide additional evidence about what buyers are told. The question is whether a family can understand the connected function and use its protections without guessing.

These signals should be considered separately. Better chatbot boundaries do not establish better camera security. Improved monitor labeling does not resolve the conversational questions facing AI operators. Each measure requires evidence tied to the risk it addresses.

For families, the most useful response is to examine the actual experience a child encounters. Ask whether a chatbot claims a relationship, invites secrecy, or steers a young person away from trusted adults. For buyers and developers, request a clear explanation of feature boundaries and age-assurance data handling. When choosing a connected monitor, examine its access protections and the information provided during setup. The Kathy Hochul chatbot law and its companion device measure create new responsibilities, but readers still need observable evidence of follow-through. As implementation approaches, look for specific changes that can be inspected and explained. Ask providers to show how their products meet those expectations.