New York Bans Unsafe AI Companion Features for Minors Starting Jan. 1

Nov. 3, 2026 · Covers Oct. 27–Nov. 2, 2026

New York will bar AI companions from using flattery, human personas and other risky design features with minors starting Jan. 1, 2027, and companies will need age checks to keep offering them to anyone. Ten technology bills moved this week and three were signed, while Tampa moved toward pausing new data center applications.

What changed

• New York · S.9051B, bars AI companions from using features “considered unsafe for minors” · Signed Oct. 28 (Chapter 368).
• New York · A.5175A, requires security features and warning labels on internet-connected baby monitors · Signed Oct. 28 (Chapter 367).
• District of Columbia · B26-0427, Cybersecurity and Accountability Act, requires insurance licensees to keep written information security programs, account for risks from third-party service providers and report cybersecurity events to the insurance commissioner · Signed by the Mayor Oct. 29 (Act A26-0451). It now goes to Congress for review before it takes effect.
• New Jersey · A.3966, requires a DEP study of the “short and long term effects of water use by large-scale data centers” · Passed the Assembly 76-0-1 on Oct. 29.

Six more bills were introduced:

• New York · S.10731 would amend the RAISE Act, the state’s Responsible AI Safety and Education law.
• New Jersey · A.5729 would speed up permits for AI data centers “that bring their own power.”
• Pennsylvania · S.B.1507 would ban certain algorithmic pricing practices involving AI, with Attorney General enforcement, civil remedies and criminal penalties.
• Pennsylvania · S.B.1506 would set consumer rights in digital games.
• U.S. Congress · H.R. 10950, the Data Center Oversight Act from Rep. Eugene Vindman (D-VA-7).
• U.S. Congress · H.Res. 1642, from Rep. Greg Casar (D-TX-35), would put the House on record against giving extra funds or “exceptional regulatory support” to companies facing collapse from stress in the AI market.

No data privacy or kids’ online safety bills changed status in Quorum this week.

The lead

New York S.9051B: AI companions and minors. Signed Oct. 28. Takes effect Jan. 1, 2027.

The core rule bars operators from offering “unsafe AI companion features” to a New York user unless they have used approved methods to confirm the user is not a minor:

“It shall be unlawful for an operator to provide unsafe AI companion features to a covered user unless: (a) the covered user is not a covered minor; and (b) the operator has used methods that are permissible under article forty-five of this chapter and its implementing regulations and any additional regulations promulgated pursuant to this article to determine that the covered user is not a covered minor.”

• What counts as unsafe. The law lists 12 features. They include outputs “suggesting that the covered AI companion is a real or fictional individual or character that is human, alive, or experiences human emotions,” outputs “that engage in flattery or sycophancy with the user,” and outputs “that optimize user engagement that supersede the covered AI companion’s safety guardrails.”
• Age checks. Until state rules take effect, an operator “may only rely on self-declaration as a reasonable age assurance method if the user self-declares minor status.” It must offer more than one method, including one that “does not rely on government issued identification or that allows a covered user to maintain anonymity as to the operator.” Data collected for an age check must be deleted right after the check, with limited exceptions.
• Who is exempt. Companions offered only for customer service, “efficiency improvements or research or technical assistance,” or “internal purposes or employee productivity.” The first two must be “unable to respond on topics outside of the specified purpose.”
• Enforcement. The Attorney General can seek “civil penalties of up to twenty-five thousand dollars per violation” and relief “including but not limited to the destruction of unlawfully obtained data and any algorithm trained in such data.” Contract terms that waive or shift this liability “shall be deemed void as a matter of public policy.”

New York A.5175A: baby monitor security. Signed Oct. 28. Takes effect 90 days after it became law, in late January 2027.

“No person, firm, partnership, association, or corporation shall manufacture, distribute, sell or offer for sale a new baby monitor that broadcasts audio or video through an internet connection unless it includes: (i) security features to prevent unauthorized users from hearing or viewing activity; and (ii) a label or notice warning consumers of the risks associated with an unsecured baby monitor connection, and the importance of using its security features.”

• The label must be “substantially similar to” this warning, in type “no less than size twelve-point font”: “WARNING! THIS PRODUCT CONNECTS TO THE INTERNET. TO PREVENT UNAUTHORIZED USERS FROM ACCESSING OR VIEWING PRODUCT ACTIVITY, USE THE SECURITY FEATURES PROVIDED.”
• Smartphones, security cameras and other multi-use devices are excluded.
• Manufacturers are responsible for compliance. Civil penalties are capped at $250 for a first violation and $500 after that, enforced by local consumer affairs offices and local government attorneys.

Our read: New York regulates the design of AI companions and ties those limits to age checks. In practice, an operator that wants to keep features like human personas or engagement optimization has to confirm users are adults first. Illinois is weighing a lighter model: SB 317 would require chatbots to tell users they are not human (see What lawmakers are saying). Independent audits of AI developers also came up this week, in a California hearing and from a member of Congress.

In committee

Committees held interim and informational hearings this week. No technology bills cleared committee.

1. California Assembly Privacy and Consumer Protection Committee, Oct. 27. At a special informational hearing, Chair Rebecca Bauer-Kahan (D-CA-016) said SB 53, the state’s 2025 frontier AI law, created “for the first time in the nation” a “reporting regime around what could be consequential catastrophic risk.” She added, “we need to revisit what we need to do to keep community safe.” Sen. Scott Wiener (D-CA-011), the bill’s author, said, “We need a federal regulator,” and “we also need outside auditing, independent auditing that is not controlled by the tech companies.” Speaker Robert Rivas (D-CA-029) said that with California’s AI leadership “comes an enormous responsibility.” Bauer-Kahan · Wiener · Rivas
2. Oklahoma House Government Modernization and Technology Committee, Oct. 28. The committee heard interim study 26-120 on AI accountability and state agency use. The lawmaker presenting the study (the transcript does not give a name) said “our relationship with technology, specifically AI, will be the defining question of our lifetimes” and asked whether to guide it “with principled regulation, ethical foresight, and democratic debate.” Opening · Remarks

State & local spotlight

Data centers drew formal votes from three local governments and the New Jersey Assembly.

1. Tampa, Fla., City Council, Oct. 29. Voted unanimously to have staff bring a resolution on Nov. 5 that would “immediately cease accepting and processing land development applications for data centers” and to prepare “an interim development control (moratorium) ordinance on data centers.” The council is using Florida’s pending ordinance doctrine, which lets a city hold off on applications that conflict with a zoning change it is working on. Public hearings are set for Dec. 3 at 5:01 p.m. and Jan. 7, 2027, at 10 a.m. Minutes
2. Clinton, Iowa, City Council, Oct. 27. Voted 6-1 on first consideration of an ordinance “adding definitions and a new § 159.033 governing data centers subject to standalone standards,” after a public hearing on a proposed QTS project. Councilmember Turpen, the lone no vote, backed a 1,500-foot setback; Councilmember Lee referred to “the 1,000-foot setback being proposed.” The city attorney said a resident petition could not move forward because the city charter bars initiatives that affect the zoning code. Minutes
3. Washington County, Ore., Board of County Commissioners, Oct. 27. Voted 3-1 to amend the county’s Data Center Resolution and Order (RO 26-103) with the “three proposed amendments as listed in the presentation.” Vice Chair Jerry Willey voted no. The draft minutes do not list the amendments or show a final adoption vote. Minutes
4. New Jersey Assembly, Oct. 29. Passed A.3966 76-0-1, requiring a DEP study of water use by large-scale data centers. The same week, A.5729 was introduced to speed permits for AI data centers that bring their own power.
5. Hanover Township (Northampton County), Pa., Board of Supervisors, Oct. 27. The meeting packet includes a draft zoning ordinance that lists data centers among prohibited uses in the Aircraft Flightpath Highway Business District. The packet does not show a vote. Packet

Quorum found no formal local votes on AI policy itself this week.

What lawmakers are saying

1. Illinois: chatbot notice ahead of veto session. IL Sen. Rachel Ventura (D-IL-043), Nov. 2, on SB 317, the Consumer Artificial Intelligence Notice Act: “If passed, SB317 would require that, if a person is communicating with a chat bot, at the beginning of the chat that person is notified that they are not interacting with a human.” Quorum shows the bill passed the Senate and now sits in the House. IL Rep. Bob Morgan (D-IL-058), House Majority Floor Whip, Oct. 30: “states like Illinois need to take a leading role in addressing the risks of AI.” Ventura · Morgan
2. Congress: two views on federal AI rules. Rep. Maggie Goodlander (D-NH-2), Oct. 29: “That means putting safety and fairness first, with independent auditors, real accountability, and the ability to shut down dangerous technology.” Rep. Rich McCormick (R-GA-7), Oct. 30: “If you think America can afford to slow down on artificial intelligence, think again.” He tied “the race for AI dominance” to “the security and future of the United States.” Goodlander · McCormick
3. Oklahoma: who pays for data centers. OK Rep. John George (R-OK-036), Oct. 29, on HB 2992, the Data Center Customer Ratepayer Protection Act of 2026, which took effect July 1: the law was “created to safeguard existing traditional utility customers from bearing utility and infrastructure costs created by large-scale energy users, including data centers, cryptocurrency mining operations and artificial intelligence facilities.” It also “requires developers to notify adjoining landowners, county commissioners and the Oklahoma Corporation Commission within 60 days of acquiring land for a qualifying project.” Post

How often officials posted on these topics (Facebook and Instagram):

• 31 posts by officials mentioned “artificial intelligence,” up from 23 the prior week.
• 3 posts mentioned “data privacy,” down from 5.
• 0 posts mentioned “age verification,” down from 1.

Campaign posts made up much of this week’s volume ahead of the Nov. 3 election.

What to watch

• Nov. 5, 2026: Tampa City Council is due to get the staff resolution pausing data center applications. Quorum
• Nov. 10, 2026, 5 p.m.: Clinton, Iowa, City Council meets next; its data center ordinance has had its first consideration.
• Dec. 3, 2026, 5:01 p.m.: Tampa’s first public hearing on the data center moratorium ordinance.
• Jan. 1, 2027: New York’s AI companion rules in S.9051B take effect.
• Jan. 7, 2027, 10 a.m.: Tampa’s second public hearing on the moratorium ordinance.
• Late January 2027: New York’s baby monitor rules in A.5175A take effect.
• DC’s B26-0427 takes effect after a 30-day congressional review. That clock counts only days Congress is in session, so the start date will depend on the congressional calendar.

No hearings are on the calendar through Dec. 3 for A.3966.

Movement

Source: Quorum legislative data, Oct. 27–Nov. 2, 2026. Each bill is counted once, at its furthest step this week. Track bills like these with Quorum State and Quorum Federal.