Int. No.
By Council Member Morano
A Local Law to amend the administrative code of the city of New York, in relation to chatbot data privacy, security, and transparency
Be it enacted by the Council as follows:
Section 1. Chapter 4 of title 20 of the administrative code of the city of New York is amended by adding a new subchapter 17 to read as follows:
SUBCHAPTER 17
CHATBOTS
§ 20-699.31 Definitions. For purposes of this subchapter, the following terms have the following meanings:
Advertisement. The term “advertisement” means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where such statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot provider and the brand, good, or service.
Affirmative consent. The term “affirmative consent” means a clear affirmative act signifying a user’s freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: (i) the request is provided to the user in a clear and conspicuous standalone disclosure; (ii) the request includes a description, written in easy-to-understand language, of the act or practice for which the user’s consent is sought; (iii) the request is made in a manner reasonably accessible to and usable by users with disabilities; (iv) the request is made available to the user in each language in which the chatbot provider provides a chatbot; (v) the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and (vi) affirmative consent to an act or practice is not inferred from the inaction of the user or the user’s continued use of a chatbot provided by the chatbot provider. The term “affirmative consent” excludes: (i) acceptance of a general or broad terms of use or similar document; (ii) hovering over, muting, pausing, or closing a given piece of content; (iii) agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; and (iv) agreement obtained through the use of a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making or choice.
Artificial intelligence model. The term “artificial intelligence model” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.
Chatbot. The term “chatbot” means any artificial intelligence model that generates information via text, audio, image, or video in a manner that simulates interpersonal interactions or conversation.
Chat log. The term “chat log” means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.
Chatbot provider. The term “chatbot provider” means any person creating, distributing, or otherwise making available a chatbot.
Input data. The term “input data” means information, including text, photos, audio, video, or files, provided to a chatbot by a user.
Personal data. The term “personal data” means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or reasonably linkable to an individual. The term “personal data” excludes information that has been lawfully made available to the general public.
Process. The term “process” means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, including the use, storage, disclosure, analysis, deletion, or modification of such data.
Profiling. The term “profiling” means any form of processing performed on input data or personal data to detect and classify or designate personality and behavioral characteristics of an individual. The term “profiling” excludes processing of chat logs for purposes of user safety.
Training. The term “training” means the use of input data to adjust or modify an artificial intelligence model. The term “training” excludes testing to identify risks of harm to users and adjustments or modifications to address identified risks of harm to users.
§ 20-699.32 Data security and access requirements. a. A chatbot provider shall develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of the personal data and chat logs maintained by the chatbot provider. The program shall be made publicly available on the chatbot provider’s website.
b. Any user of a chatbot shall have the right to access, at any time, any of the user’s own chat logs that a chatbot provider has retained in a downloadable and human- and machine-readable format.
§ 20-699.33 Transparency requirements. a. A chatbot provider shall provide clear, conspicuous, and explicit notice to users that such users are interacting with a chatbot rather than a human prior to the chatbot generating any outputs, every hour thereafter, and each time a user prompts the chatbot about whether it is a real person. The notice shall be accessible to users with disabilities.
b. The text of the notice provided pursuant to subdivision a of this section must appear in the same language as the one in which the user is interacting with the chatbot, in a font size easily readable by an average user, and no smaller than the largest font size of other text appearing on the interface on which the chatbot is provided.
§ 20-699.34 Prohibited acts. a. A chatbot provider shall not process personal data other than input data to inform chatbot outputs unless:
1. It is necessary to process personal data to fulfill an express request made by a user; and
2. The chatbot provider has obtained affirmative consent from that user.
b. A chatbot provider shall not process a user’s chat log or personal data when the chatbot provider knows or has reason to know that a user is under 18 years of age:
1. Unless the chatbot provider has obtained the affirmative consent of that user’s parent or legal guardian; and
2. For training purposes, under any circumstances.
c. A chatbot provider shall not process a user’s chat log or personal data for training purposes when a user is over 18 years of age unless the chatbot provider has obtained affirmative consent from that user.
d. Beyond what is necessary to fulfill an express request made by a user, a chatbot provider shall not:
1. Process a user’s chat log to:
(a) Determine whether to display an advertisement for a product or service to the user;
(b) Determine a product, service, or category of product or service to advertise to the user; or
(c) Customize an advertisement or how an advertisement is presented to the user;
2. Process a user’s chat log or personal data to engage in profiling; or
3. Use any classification or designation of a user’s personality or behavioral characteristics created through profiling.
e. A chatbot provider shall not sell a user’s chat logs to a third party, unless the chatbot provider has obtained affirmative consent from that user.
f. A chatbot provider shall not retain a user’s chat log for longer than 10 years, unless retention is necessary to comply with this subchapter or otherwise required by law.
g. A chatbot provider shall not discriminate or retaliate against any user, including by denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the user, for:
1. Refusing to consent to the use of chat logs or personal data for training purposes; or
2. Accessing the user’s own chat logs.
h. A chatbot provider shall not indicate or imply in advertisements or in the interface or outputs of a chatbot that any output data is being provided by, endorsed by, or equivalent to those provided by:
1. A licensed healthcare professional;
2. A licensed legal professional;
3. A licensed accounting professional;
4. A certified financial fiduciary or planner; or
5. Any other licensed or certified professional.
§ 20-699.35 Safety assessment and mitigation. A chatbot provider shall assess its chatbot for risks of harm to users on a monthly basis and shall mitigate any risks of harm accordingly. A chatbot provider shall make information about identified chatbot safety risks and mitigation publicly available on its website.
§ 20-699.36 Liability of chatbot providers. a. A chatbot provider has a duty to ensure that the use of its chatbot does not cause injury.
b. A chatbot provider is liable for any injury it causes a user through the use of its chatbot, including when such chatbot provider exercises all reasonable care in the design and distribution of the chatbot and such chatbot provider does not directly distribute the chatbot to the user or otherwise enter into a contractual relationship with the user.
c. Chatbots are products for the purposes of product liability actions.
§ 20-699.37 Rules. The department, or any other agency or office designated by the mayor, shall promulgate rules in furtherance of the implementation and enforcement of this subchapter.
§ 20-699.38 Penalties. Any person who violates any provision of this subchapter or any rule promulgated thereunder shall be subject to a civil penalty of not more than $25,000 for each violation.
§ 20-699.39 Enforcement by the corporation counsel. The corporation counsel or such other persons designated by the corporation counsel on behalf of the department may initiate in any court of competent jurisdiction any action or proceeding that may be appropriate or necessary for correction of any violation issued pursuant this subchapter, including mandating compliance with the provisions of this chapter or such other relief as may be appropriate.
§ 20-699.40 Private cause of action. Any person alleging a violation of this subchapter may bring a civil action, in accordance with applicable law, in any court of competent jurisdiction. Such court may order compensatory, injunctive, and declaratory relief.
§ 2. This local law takes effect 180 days after it becomes law.
ABI
LS #26862
9/24/2026 5:04 PM