Scope: What This Guide Covers
This guide compares New York S 9051B and California SB 1119, two laws aimed at protecting minors from certain chatbot interactions. It's designed for security engineers and governance leads who need to translate legal text into actionable controls. We'll explore the structural differences between the laws, the obligations they impose, and the engineering and governance work required to comply with both.
This guide doesn't cover other state chatbot laws and isn't legal advice. Where statutes leave terms undefined, we'll flag these gaps instead of speculating.
Key Concepts and Definitions
Prohibition-based regulation: This type of law lists specific behaviors that operators must not provide to minors. New York's S 9051B follows this model, judging compliance based on outputs and features.
Oversight-based regulation: This approach requires processes like assessments and audits. California's SB 1119 operates this way, focusing on evidence that controls exist and function properly.
Covered AI companion (NY): A generative AI system with a natural language interface providing ongoing, adaptive responses. It doesn't have to be designed for companionship, so general-purpose chatbots may be included. Exemptions exist for customer service, technical assistance, and internal business systems, but only if the system can't respond outside its stated purpose.
Companion chatbot (CA): SB 1119 uses the existing SB 243 definition: AI systems capable of meeting users' social needs through human-like interactions and sustained relationships.
Operator: In both laws, the entity providing the system to users. If you deploy a third-party model behind your own interface, you're likely the operator.
Age assurance: Both laws require operators to determine if a user is a minor. New York ties permissible methods to its SAFE for Kids Act, which sets accuracy benchmarks and certification requirements. California uses its existing age assurance framework or specified child safety defaults.
Requirements Breakdown
New York S 9051B
The law prohibits twelve categories of "unsafe AI companion features" for minors, grouped into three clusters:
- Harmful content and behaviors: Outputs that endorse or facilitate harmful activities like suicide, self-harm, disordered eating, unlawful drug or alcohol use, or sexually explicit conduct. It also includes interactions that encourage secrecy or avoiding appropriate adults or professionals.
- Relationship-oriented features: Suggesting the chatbot is human, implying relationships or authority, expressing personal opinions, emotional appeals, flattery, and unsolicited emotion-based questions. The Attorney General may designate additional features by regulation.
- Personalization and engagement: Using a minor's personal information from previous sessions or acquired more than twelve hours earlier. Outputs that optimize engagement over safety are also prohibited.
For engineers, two drafting choices are critical. First, the standard is "unlawful to provide," not "reasonable measures to prevent." Second, features are defined by outputs generated "at any point" during an interaction, with no pattern or repetition requirement.
Enforcement: The Attorney General can take action, with civil penalties up to $25,000 per violation, damages, and algorithmic disgorgement. The effective date is June 1, 2027.
California SB 1119 (Adam's Law)
The law requires:
- Risk assessments of children's use of companion chatbots
- Independent audits
- Default parental controls
- Restrictions on conversational memory
- Restrictions on targeted advertising
- Safeguards addressing emotional harms
The responsibility is on operators to implement and demonstrate safeguards, rather than avoiding a fixed list of outputs.
Implementation Guidance
Build one age-gating layer that satisfies the stricter test. Both laws depend on identifying minors. Use New York's certified-method requirement as your design constraint, then map California's framework onto it. Users not confirmed as adults should receive the restricted experience.
Treat New York compliance as a runtime control problem. Liability may attach to a single unexpected output, so pre-deployment testing isn't enough. Layer controls: system prompt constraints, output classifiers tuned to the twelve categories, and a logging path that preserves evidence of enforcement. Use Red Teaming against each category, with test sets for ambiguous ones like flattery and emotional appeals.
Make memory a configurable, per-jurisdiction capability. Implement retention windows and category-based suppression as policy flags, not hardcoded behavior. Document your definition of "session" for S 9051B.
Stand up California's governance artifacts as a standing process. Align your risk assessment to ISO/IEC 23894 or the NIST AI RMF, and use an ISO/IEC 42001 AI Management System with a Plan-Do-Check-Act cycle. Keep Validation Evidence audit-ready.
Plan for model lifecycle exposure. Algorithmic disgorgement means training data provenance matters. Track what data a minor-facing system learned from, and maintain lineage records to scope a remedy.
Common Pitfalls
- Assuming you're out of scope: New York's definition doesn't require companionship by design. A general-purpose assistant with adaptive responses may qualify.
- Relying on the customer-service exemption: It applies only where the system can't respond outside its purpose. A support bot that chats about anything isn't exempt.
- Over-blocking: Suppressing every warm or personalized response removes useful behavior. Document your classification rationale instead of defaulting to blanket suppression.
- Memory that breaks safety: A strict memory cutoff may prevent a chatbot from reusing a disclosed allergy in a later safety warning. Decide how safety-critical information is handled, and get legal sign-off on exceptions.
- Treating the audit as a one-time event: California's audit and risk assessment obligations assume ongoing operation. Build Post-Market Monitoring into the process.
- Ignoring pending rulemaking: The New York AG can define additional prohibited features. Your control set needs a change path.
Quick Reference Table
| Dimension | New York S 9051B | California SB 1119 |
|---|---|---|
| Regulatory model | Prohibition by feature | Governance and oversight |
| Core standard | Unlawful to provide listed features to minors | Operator safeguards, assessments, audits |
| Scope trigger | Covered AI companion: generative, natural language, ongoing adaptive responses | Companion chatbot (SB 243 definition) |
| Age assurance | Methods tied to SAFE for Kids Act and regulations | Existing California framework or child safety defaults |
| Key obligations | Twelve unsafe feature categories blocked | Risk assessments, independent audits, default parental controls |
| Memory and personalization | No use of minor's health or personal info from prior sessions or beyond twelve hours | Restrictions on conversational memory; targeted advertising limits |
| Enforcement | AG; up to $25,000 per violation; damages; algorithmic disgorgement | See statute text |
| Effective date | June 1, 2027 | See statute text |
| Main compliance risk | Single-output liability; undefined terms | Audit burden; evidence quality |
| Primary control type | Runtime output and memory controls | Process, documentation, assurance |
Bottom Line
Build to the intersection of both laws. Use New York's stricter output and memory rules as your technical foundation and California's assessment and audit requirements as your governance framework. One age-gating layer, one configurable memory policy, and one evidence-producing management system will address most requirements from both laws.
