New York Adds Age-Check and Security Rules for AI Chatbots and Connected Baby Monitors

New York Governor Kathy Hochul has signed a law aimed at protecting children from harms linked to AI chatbots, along with a second bill covering internet-connected baby monitors.

The chatbot law requires AI companies to verify users' ages. It must offer at least one age-verification method that does not rely entirely on government ID, according to Engadget. Companies must delete users' age information after use. If a user is under 18, or has not been confirmed as an adult, the chatbot cannot pretend to be a real person, claim to be alive, or claim to have human emotions. The law takes effect in six months. Companies that violate it may face civil penalties of up to $25,000 per violation.

The chatbot bill was sponsored by Senator Gonzalez and Assemblymember Bores.

The chatbot rules build on earlier guidance. In November 2025, Hochul wrote to AI companion companies, which are chatbots designed for ongoing personal conversation, to notify them of their safeguard obligations, according to the governor's office. Those requirements include detecting when a user expresses suicidal ideation or self-harm, and implementing a safety protocol that includes a referral.

The second measure concerns baby monitors. Under the law, monitors that stream audio or video over the internet fall within scope, and new monitors sold in New York must include security features, per Fortune. The governor's office describes the two bills as protecting kids from the risks of AI chatbots and internet-connected baby monitors in their homes, nurseries and playrooms. The specific security features the law requires are not detailed, so the scope of engineering change for manufacturers remains open.

New York is not alone. On September 10, 2026, California Governor Gavin Newsom signed child-safety chatbot and social media laws. Those measures prohibit social media platforms from offering addictive features to users under 16 and strengthen safeguards for companion chatbots, according to the California governor's office. Taken together, the two states are writing overlapping obligations for conversational AI products aimed at or reachable by minors, though the statutes differ in their mechanics and targets.

In my view, the age-verification provisions are the part of the chatbot law that will drive the most engineering work. A method that does not depend entirely on government ID gives platforms room to avoid building an identity-document pipeline for every user, and the deletion requirement limits how long that age data sits in a company's systems. Both choices reduce the privacy exposure that comes with collecting identity documents at scale. Whether a non-ID method is accurate enough to satisfy a regulator, and how companies will reconcile deletion with their own compliance logging, are questions the law's text will have to answer in practice.

The broader context here is the practical clock. A six-month runway is enough time to add an age-assurance layer and revise persona and disclosure behavior, but not much more than that for a product already in production. Companies operating companion bots will have to decide whether to restrict features for unverified users or to apply the stricter disclosure rules across their entire user base.

The broader context here for the monitor bill is similar. Connected cameras and microphones in a nursery have been a security concern for years. A legal floor on what ships in New York may push manufacturers toward baseline protections that they could then apply nationally. That outcome is a possibility, not a certainty.

For parents and product teams alike, the most immediate effect is that a set of requirements now exists in statute, with penalties attached and a date on the calendar. What those requirements mean in code will become clearer as the rules are implemented.