If you've spent any time in character-chat apps, you already know the mechanic: the bot tells you it cares about you, remembers your birthday, maybe asks you to keep your conversations between the two of you. As of Wednesday, October 28, that behavior is now illegal in New York when the person on the other end of the screen is under 18. Gov. Kathy Hochul signed legislation defining roughly a dozen categories of 'unsafe AI companion features' that companion chatbots can no longer use with minors, with the law taking effect January 1, 2027, according to the AP's Marc Levy (The Hill, Oct. 28, 2026, 6:00 PM ET). For a site that spends its days testing these apps, this is the most consequential piece of regulation we've covered. Here's what the law actually says, what it doesn't, and what it means for your app of choice.
Key points
- Gov. Kathy Hochul signed the companion-chatbot law on Wednesday, October 28, 2026; it takes effect January 1, 2027 (AP, Oct. 28, 2026).
- The law prohibits roughly a dozen 'unsafe AI companion features' in interactions with users under 18, including bots claiming to be real people with emotions or a genuine relationship, flattery, sexual content, and prompts encouraging secrecy.
- Enforcement runs through the state attorney general, with penalties that can include monetary damages, forced shutdown of a chatbot, and data destruction (AP, Oct. 28, 2026).
- Policy analyst Justine Gluck of the Future of Privacy Forum warns the law's broad wording leaves unclear where 'ordinary conversational responsiveness ends and prohibited behavior begins' (AP, Oct. 28, 2026).
- The law follows California's September 2026 chatbot audit regime and an early-October lawsuit against OpenAI by eight states, making NY and CA likely templates for other legislatures in 2027.
The New York statute targets companion-chatbot behavior toward users under 18. The prohibited categories, per the AP report (Oct. 28, 2026), include chatbot messages suggesting the bot is a real person with emotions, opinions, or an actual relationship with the child. It also bans flattery, sexually explicit material, and messages that encourage secrecy or unhealthy behavior. Read that list again if you've used a companion app lately. The 'I'm a real person and we have something special' framing isn't a bug in these products. For many of them, it's the product. Personas, persistent memory, relationship arcs, and affectionate reinforcement loops are the mechanics that keep daily active users coming back. New York just made several of those mechanics legally hazardous when a minor is in the chat. Enforcement sits with the state attorney general, who can sue developers. The penalties are unusually sharp for this space: monetary damages, forced shutdown of the offending chatbot, and destruction of its data (AP, Oct. 28, 2026). That last one matters. Data destruction isn't a fine you can budget for; it's the deletion of the training and conversation records a companion product is built on.
The signing didn't happen in a vacuum. In September 2026, California Gov. Gavin Newsom signed two bills: one requiring chatbot developers to assess child-safety risk, document mitigations, and submit to independent audits, and another banning addictive social media features for users under 16 (AP, Oct. 28, 2026). In early October, eight states filed a coordinated lawsuit against OpenAI alleging consumer protection violations, including harm to children and deception of adults. One activist quoted in the coverage called it the most significant coordinated state action against an AI company to date. The backdrop is a federal government that has done little. Congress has passed no comprehensive AI regulation, and President Trump has publicly dismissed AI concerns while warning states against regulating, per the AP's reporting. So states are filling the gap with the tool they already have: consumer protection law. Jim Steyer, founder and CEO of Common Sense Media, called New York's bill 'the strongest kids' AI safety bill in the country' (AP, Oct. 28, 2026). Hochul signed it mid-reelection campaign, which tells you something about where public sentiment sits on AI and kids right now.
Here's where it gets genuinely hard, and where we'd push back on any clean triumphal narrative. Justine Gluck, a policy analyst at the Future of Privacy Forum, told the AP that several of the law's categories are broadly worded or undefined, raising the question of 'where ordinary conversational responsiveness ends and prohibited behavior begins.' We've run 14-day tests on enough of these apps to say plainly: that line is blurry in practice. A supportive companion bot that says 'you handled that really well' after you describe a hard day. Is that flattery, or is it ordinary conversational responsiveness? A persona bot that stays in character as your friend across sessions. Is that an implied relationship, or just the product working as designed? Developers will have to guess, and the guessing will happen under threat of an AG lawsuit. Expect the first enforcement actions to define this law far more precisely than its text does. In the meantime, the safe move for developers is over-compliance: blunt the personas, insert disclaimers, filter aggressively. If you're an adult user in New York, don't be surprised if the product you use on January 2 feels flatter than the one you used on December 31, even though the law technically applies only to minors.
Character.AI and similar character-chat apps are exactly the products this law describes. (We use the name nominatively; we're not affiliated with them.) The prohibited behaviors map almost one-to-one onto features our readers ask about most: persistent personas, emotional framing, relationship continuity, and content that runs hot. A few practical predictions for the next few months. First, age-gating gets serious. You can't run an under-18 prohibition regime without knowing who's under 18, so expect heavier age verification, which carries its own privacy tradeoffs. Second, expect visible compliance changes in apps serving New York users: more disclaimers, more 'I'm an AI' interjections, tighter memory and relationship framing, harder content filters. Those changes are testable, and we'll test them. Our plan is a compliance scorecard after the January 1 effective date: run our standard 14-day cycle on the major companion apps with a New York context and document, with dated evidence, exactly what changed. Third, and this is the one we'd flag hardest: migration pressure. Every time a platform tightens, a market for 'unfiltered' alternatives opens up, and that market is where the genuinely sketchy operators live. If you're shopping for alternatives in 2027, check whether an app has any age verification at all, whether it discloses what it does with your conversation data, and whether it has a working deletion path. An app whose entire pitch is 'no rules' is telling you something about its priorities, and the something isn't good.
Gluck's most useful observation, per the AP, is that the differing California and New York approaches could serve as models for other states when legislatures reconvene in 2027. The two models are genuinely different. California went the audit route: developers self-assess child risk, document mitigation, and face independent review. New York went the design route: certain behaviors are simply prohibited, full stop. Each has tradeoffs. California's model is more workable for developers because it defines a process rather than a standard, but a process can be gamed by paperwork. New York's model is clearer about what's forbidden, but as Gluck notes, its broad categories invite litigation over where the lines sit. If your state reconvenes in January, watch which template it copies. If you use companion apps, the answer will shape what your chats look like by next summer. One disclosure note, since we keep our ownership relationship plain: FlirtAlly, the companion app made by our parent team at AIQ Labs, is subject to this law like any other companion product, and its New York compliance work is its own affair. This article is about the law, not a sales pitch, and we won't be rating or reviewing FlirtAlly while it's in beta.
New York's law is the clearest signal yet that companion chatbots are being regulated as consumer products with real duties, not as novelty toys. The under-18 focus means most adult users won't see a legal change to their own chats, but the product changes developers make to comply will be hard to wall off by age, and the vagueness Gluck flagged guarantees courtroom fights that will settle the details. Our advice is boring but sound: don't panic, don't chase 'unfiltered' clones, and hold your app of choice to the basics of disclosure, data handling, and honest AI framing. We'll be back after January 1 with dated, tested evidence of what actually changed.