To protect kids from AI chatbots, New York now wants every chatbot company to figure out who is a child. That means more identity checks, and more data on the line.
Governor Kathy Hochul signed a law requiring AI companies to verify user ages. Companies must offer at least one method that doesn’t rely entirely on government ID, and they have to delete the age information after use. Until a user is confirmed as an adult, the chatbot is treated as if it’s talking to a minor.
Those restrictions are specific. Chatbots can’t claim to be human or have emotions, can’t claim a romantic or authority-figure relationship with a child, and can’t reuse a child’s private health details from earlier chats. They also can’t promote suicide, self-harm, eating disorders or drug use, push kids to keep secrets, or produce sexual content.
Enforcement has teeth. The attorney general will run a public complaint site. Penalties reach $25,000 per violation, and companies may have to delete unlawfully collected data and the models trained on it. That model-deletion remedy is the part to watch. The law takes effect in six months.
Now the skeptical bit. "Delete after use" is a promise, not a technical guarantee, and the law doesn’t change the incentive to collect. Face scans, ID uploads and third-party verifiers create exactly the sort of sensitive data pile that leaks. A "not entirely" ID-based option could still be a biometric estimate. Users should ask who runs the check and what they keep.
The politics are moving fast. Common Sense Media’s Jim Steyer called it a template for the country, and eight states recently sued OpenAI over child safety. New York City also banned generative AI in public schools through eighth grade for a year.
Hochul also signed a separate law requiring internet-connected baby monitors sold in the state to block unauthorized viewing and listening, with warning labels about security risks. It takes effect in 90 days. Frankly, that one should have been standard years ago.