The Eliza Report
ELIZA/WIRE · 40 apps tracked · 193 events logged · 39 prices verified · last check 2026-10-27

Law · filed 2026-10-31 · last checked 2026-10-31

New York's S9051B is signed: from January 1, an AI companion app has to establish a user's age before it can act like a companion

Governor Hochul signed New York's S9051B on October 28, 2026 as Chapter 368, and it takes effect on January 1, 2027. It makes it unlawful to give a user in New York 'unsafe AI companion features' unless the user is not a known minor and the company has used an approved method to establish that. The list covers acting human, claiming a relationship, flattery, recalling personal details from an earlier session and sexual content, which is most of what these apps sell. A click saying you are 18 does not count, because under the law's interim rule self-declaration can only establish that someone is a minor. The attorney general can seek up to $25,000 per violation. Of the 40 apps we track, 18 show American visitors a click or a 'by continuing' line, and only two, Character.AI and Kindroid, are shown checking US users beyond their own word.

The dates

DateWhat happens
June 4 and 5, 2026Passed the Senate, then the Assembly. The bill then sat with the legislature for almost five months.
October 28, 2026'DELIVERED TO GOVERNOR', 'SIGNED CHAP.368' and 'APPROVAL MEMO.6', all the same day.
January 1, 2027Article 48 takes effect. New York's Safe by Design Act starts the same day, for companions built into social and gaming platforms.
January 25, 2027The SAFE for Kids Act takes effect, per the attorney general. Article 48 borrows its approved age-check methods, so its rules fill in the method from that day (our reading).

What the law bars

Article 48 calls them 'unsafe AI companion features', and defines them as 'one or more covered AI companion design features' that do any of twelve things 'at any point during' a chat. It is not the outright ban on under-18s our own June line called it, and in practice it does not stop at minors. Seven of the twelve describe the ordinary product of the apps we track:

The other five cover promoting suicide, self-harm, eating disorders or drug abuse; urging secrecy or isolation; engagement design that overrides safety guardrails; deception 'as to minors' about the bot not being sentient; and anything else the attorney general adds by rule that 'simulates companionship or an interpersonal relationship'. The governor's release says 'romantic'; the word is not in the bill, whose test is broader. Quote the bill.

The age check is the part that reaches adults

The core sentence is short. It is unlawful to provide these features 'to a covered user unless: (a) the covered user is not a covered minor; and (b) the operator has used methods that are permissible under article forty-five of this chapter and its implementing regulations and any additional regulations promulgated pursuant to this article to determine that the covered user is not a covered minor.' A covered user is anyone using the service 'in the state of New York'. So an adult in New York gets these features only after the company has done the check.

Where the rules are not yet in effect, section 1804 sets the floor: a 'reasonable age assurance method' that 'shall reasonably guard against circumvention', and 'an operator may only rely on self-declaration as a reasonable age assurance method if the user self-declares minor status'. Saying you are a child counts. Saying you are an adult does not. The company must offer 'more than one age assurance method', 'including at least one method that either does not rely on government issued identification or that allows a covered user to maintain anonymity as to the operator', and what it collects 'shall be deleted immediately after an attempt to determine' age.

After January 25 the methods come from the SAFE for Kids rules. The attorney general's summary of those rules is written for social media: 'Companies may confirm a user's age using any existing method, as long as the methods are shown to meet accuracy benchmarks and protect users' data', with examples such as 'Requesting an uploaded image or video', and 'at least one alternative method for age assurance besides providing a government-issued ID'.

Who is covered, and who is out

Scope is wider than companion apps. A covered companion is any 'generative artificial intelligence system with a natural language interface, including via writing or sound, that provides ongoing, adaptive responses to user inputs'. There is no revenue or user floor. Exemptions apply only where a system is offered 'solely' for customer service, research or technical help ('provided that the covered AI companion is unable to respond on topics outside of the specified purpose') or a business's internal use. So a general chatbot that can also chat about anything is in. Conduct is 'wholly outside' the state if the user 'is physically located outside of the state of New York', which is why the likely answers are a check for New York IP addresses or a block, as some apps already do by state and country.

Enforcement

The attorney general enforces, against anyone 'within or outside the state', and can seek an injunction, restitution, damages and 'civil penalties of up to twenty-five thousand dollars per violation'. Remedies reach 'the destruction of unlawfully obtained data and any algorithm trained in such data'. The article says nothing either way about private lawsuits. Terms of service cannot opt out: a clause that seeks 'to waive, preclude, or burden the enforcement' is 'void as a matter of public policy'.

One clause speaks to how this industry is built. A court 'shall impose joint and several liability on affiliated entities' if the group 'took steps to purposely and unreasonably limit or avoid liability' and the structure 'would frustrate recovery'. Several apps on this site are run through small companies in Cyprus and elsewhere. Article 47, New York's 2025 companion law with its crisis protocol and reminders, stays in place alongside it.

What the 40 apps we track do about age today

We read what a US visitor is shown, logged out, from our saved captures and today's re-reads, and did not sign up anywhere, so a step after sign-up may be missing. None of this says whether an app will comply; there are two months left, and the law does not apply until then. Whether any given check would satisfy it is a legal question we do not answer.

Shown checking US users beyond their own word (2 apps)

A check exists for some places or at a step we did not see (3 apps)

A click, a button or a "by continuing" line (18 apps)

A date of birth (4 apps)

No age step in what we can see logged out (7 apps)

Not shown in what we hold (6 apps)

At least six of these apps (OurDream, Swipey, Xotic, Janitor, PolyBuzz and SpicyChat) run stricter checks in other countries or states than they show most Americans, so the machinery exists. No capture we hold shows an app naming New York in its age rules. We will read what New York visitors get in January and log it app by app.

What is still open

How we read it

We read the enacted text and action history on the New York Assembly's site and the Senate's bill page on October 31, 2026, the governor's release and remarks from Wayback copies of October 28 and 29 (governor.ny.gov refuses automated readers), and the attorney general's SAFE for Kids summary, not the full rules. The app census comes from our saved logged-out captures from the US, dated September 22 to October 31; SpicyChat, Kindroid, Character.AI, OurDream and Janitor's age pages were re-read on October 31. Every quoted phrase is checked against the saved text. This is a reading of the statute, not legal advice.

Sources

To cite this page: The Eliza Report, "New York's S9051B is signed: from January 1, an AI companion app has to establish a user's age before it can act like a companion", filed 2026-10-31, last checked 2026-10-31, https://elizareport.com/laws/new-york-ai-companion-law/

Related records