New York’s AI Companion Law Explained: What It Means for Child Safety

New provision: On 28 October 2026, New York signed S9051B into law as Chapter 368. The signed text adds Article 48 to the state’s General Business Law and takes effect on 1 January 2027. Article 47 remains a separate framework for AI companion safeguards.

Scope: The new law targets covered AI companions used in New York and treats a person below 18 as a minor. An AI companion is a conversational system that can simulate interpersonal interaction. The Act provides specified exceptions for some narrowly limited customer service, research, technical support and internal business uses.

Simulated relationships: The law addresses features that mislead minors into treating a system as a sentient companion or simulate personal relationships in specified ways. It also addresses uses of sensitive information from previous sessions or from more than twelve hours earlier, within the statutory definition of unsafe features.

Harmful outputs: Restrictions cover sexually explicit outputs, encouragement of self-harm, prompts to keep interactions secret or avoid seeking help, and engagement optimisation that overrides safety guardrails. The New York Attorney General can seek remedies including injunctions and civil penalties of up to $25,000 per violation.

Age checks: Age assurance estimates or verifies whether a person falls within an age group. Pending applicable rules, the Act requires reasonable methods that limit retention and guard against circumvention. Operators must offer more than one method, including one that avoids government-issued identification or lets the user remain anonymous to the operator.

Data minimisation: Gathering identity documents or other personal information at scale introduces additional exposure. The Act limits age-assurance data to the determination and requires prompt deletion after an attempt, subject to legal exceptions. A system can often verify an age band without retaining the underlying identity record.

Personal data: Section 9 of the Digital Personal Data Protection Act, 2023, provides for verifiable parental consent before processing children’s personal data, subject to the statutory framework and notified exceptions. It also addresses processing detrimental to children’s well-being and restricts tracking, behavioural monitoring and targeted advertising directed at children. The Act generally defines a child as a person under 18.

Timing and policy focus: India’s commencement notification phases in the Act. Section 9 is scheduled to come into force 18 months after publication of the November 2025 notification. India’s provision governs personal data processing. New York’s Article 48 specifically regulates the features and behaviour of covered AI companions.

Testing: A single-turn safety check can miss risks that build over many conversations. Providers can test extended interactions across languages and contexts, including attempts to bypass age gates and situations where a child seeks help.

Children’s rights: UNICEF’s policy brief recommends a child-rights approach. Providers should assess risks before launch, tell children clearly that the system is artificial, provide age-appropriate controls and make reporting accessible. Rules should preserve beneficial educational access and protect children’s privacy.