Serves under-18s, in New York

N.Y. Gen. Bus. Law section 899-bb (Article 39-F, added by L. 2019, ch. 117 (S5575-B/A5635-B), section 4) · Read the law's page

• This binds any person or business that owns, licenses, or maintains computerized data including the private information of a New York resident; a business already a compliant regulated entity under Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or 23 NYCRR Part 500 (the New York Department of Financial Services cybersecurity regulation for a financial-services licensee) is deemed to comply.
• Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).
• A small business, fewer than 50 employees, under $3,000,000 in gross annual revenue in each of the last three fiscal years, or under $5,000,000 in year-end total assets, may scale its program's administrative, technical, and physical safeguards to its own size, complexity, and the sensitivity of the personal information it collects.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of General Business Law 349, seeking injunctive relief and a civil penalty of up to $5,000 per violation under General Business Law 350-d.

N.Y. Gen. Bus. Law art. 39-FF, sections 899-EE to 899-MM (2024 N.Y. Laws ch. 121) · Read the law's page

• Applies to operators of websites, online services, apps, and connected devices directed to or reasonably likely to be used by minors.
• Do not process, sell, or share the personal data of a user under 18 for targeted advertising, profiling, or other non-essential purposes without informed consent.
• Honor browser or device signals indicating that a user is a minor.

N.Y. Gen. Bus. Law art. 39-FF, §§ 899-ee to 899-mm (2024 N.Y. Laws ch. 121) · Read the law's page

• If you operate a website, online service, application or connected device that you actually know is used by a minor under 18, or that is primarily directed to minors, do not process that user's personal data, or let a processor or third-party operator process or collect it, unless the user is 12 or younger and the processing is permitted under 15 U.S.C. § 6502, or the user is 13 or older and the processing is strictly necessary for a purpose the article lists or you have the user's informed consent (Section 899-ff(1) and (2)).
• Ask for informed consent separately from any other transaction, with no design that obscures or impairs the user's decision, state that the processing is not strictly necessary and that the user may decline without losing use of the service, and make the option to refuse the most prominent option (Section 899-ff(3)(a)).
• Let a user revoke consent at any time as easily as it was given, and after a refusal or revocation do not ask again for the same processing for the following calendar year (Section 899-ff(3)(b) and (c)).
• Do not withhold, degrade, lower the quality of or raise the price of a product, service or feature because you did not obtain parental consent or informed consent, unless the processing is strictly necessary to provide it (Section 899-ff(4)).
• Do not purchase or sell a covered user's personal data, or allow a processor or third-party operator to do so (Section 899-ff(5)).
• Within thirty days of determining or being told that a user is a covered user, delete the user's personal data that you may not keep, direct your processors to delete it, and notify any third-party operator you know received it (Section 899-ff(6)).
• Before you disclose personal data to a third-party operator, or let one collect it, tell it when your service is primarily directed to minors or when the data concerns a covered user (Section 899-ff(7)).
• Do not disclose a covered user's personal data to a third party, or let one process it, without a written, binding agreement that sets out the nature and purpose of the processing, the instructions for using or further disclosing the data, and each party's rights and obligations (Section 899-gg(1)).
• Treat a user as a covered user where the user's device signals that the user is or shall be treated as a minor, and follow a device's clear and unambiguous signal about consent (Section 899-ii).
• When you learn that a user is no longer a covered user, stop processing the user's personal data that the article would otherwise restrict until you obtain informed consent, and notify the user that the article's protections no longer apply (Section 899-hh).

N.Y. Gen. Bus. Law art. 48 (proposed §§ 1800-1802), S9408-A / A11144-B · Read the law's page

• Passed by both houses and not signed, so this binds nobody yet; what follows is what the bill would require as passed.
• Do not manufacture, exchange, hold for sale, distribute or sell in New York a children's toy with an AI companion embedded in or integrated with it.
• If the bill becomes law, the prohibition takes effect on the ninetieth day after that and expires five years later.

N.Y. Gen. Bus. Law art. 45-B, sections 1539-1547 (2026 N.Y. Laws ch. 58, part Y) · Read the law's page

• Applies to online platforms likely to be used by minors, including social media, gaming, and digital messaging platforms.
• Apply privacy-protective default settings for users you know are minors, including restricting contact and profile recommendations from unknown adults and limiting financial transactions.
• Require parental approval before a minor weakens those default settings.
• Turn AI companion features off by default for users you know are minors.
• Determine whether a user is a minor through age assurance, never self-declaration of age, using the methods the Attorney General's rules accept; where those rules are not in effect, use a reasonable method that guards against circumvention, minimizes the retention of the information collected, and is offered alongside at least one other method, one of which does not rely on government issued identification or lets the user stay anonymous to the operator.

N.Y. Gen. Bus. Law art. 48 (§§ 1800-1805), ch. 368 of 2026 (S9051-B) · Read the law's page

• Do not provide a covered AI companion with unsafe features, as this article defines them, to a covered user unless the user is not a covered minor (a minor you actually know is one) and you have used a permitted age-assurance method to determine that.
• Unsafe features include outputs facilitating suicide, self-harm, disordered eating or sexually explicit conduct or child sexual abuse material, outputs encouraging secrecy or self-isolation, deceiving a minor about the companion's non-human nature, and engagement-optimizing outputs that override the companion's own safety guardrails.