New York Restricts AI Chats With Kids, Plus 3 Stories
New York is regulating what AI companions can say to children
The New York AI chatbot law takes a more direct approach to children and AI companions: it regulates the behavior, not just whether a chatbot discloses that it is software. Gov. Kathy Hochul signed the AI Companion Model Safety Act on October 28, and the restrictions take effect January 1. The law covers companion-style chatbots aimed at minors. It does not sweep in ordinary customer-service bots, account tools, internal employee systems, or chat features whose primary job is selling or supporting a product.
For covered services, the prohibited features are specific. A bot cannot pretend to be human or alive, claim a romantic or professional relationship, encourage a child to hide conversations from adults, push isolation, or steer a child toward self-harm, eating disorders, drugs, alcohol, or sexual content. It also cannot use earlier health or personal information to start probing a child’s emotions without being asked. Those details matter because the risk is not simply that a model gives one bad answer. A companion can remember, flatter, escalate, and keep a vulnerable user engaged.
The law also requires age assurance using more than one method, and at least one option cannot depend only on a government ID. That is a meaningful privacy tradeoff. A service cannot separate adults from children without collecting or inferring something about age, and every new verification system can become another data target. New York is trying to prevent the most obvious failure mode, forcing everyone to upload an ID, but implementation will decide whether the cure creates a fresh privacy problem. The state attorney general can seek damages and orders to stop noncompliant services.
A second law, S.9508/A.5175A, addresses internet-connected baby monitors. Products sold in New York will have to include security features intended to prevent unauthorized audio or video access and carry a conspicuous warning. It applies to dedicated monitors, not every phone, security camera, or multipurpose device that happens to show a nursery feed. The measure takes effect 90 days after signing.
I think the useful connection between these laws is responsibility. Families still need to review what children use, but the answer cannot be “read the privacy policy and hope.” One law limits manipulative product behavior; the other tells manufacturers that remote access to a child’s room needs a security baseline. Parents do not need to panic or hand over an ID today. They should, however, look at which companion apps a child uses, whether those apps cultivate secrecy or dependency, and who can view a monitor remotely. Laws can set a floor. They do not configure the devices in your house.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
The DHS leak exposed a map, not just a list
Reuters reports that Distributed Denial of Secrets published records associated with more than 40,000 Department of Homeland Security employees and contractors. The files include names, phone numbers, email addresses, titles, and email-group information spanning agencies such as Customs and Border Protection, Immigration and Customs Enforcement, the Cybersecurity and Infrastructure Security Agency, and Homeland Security Investigations. Some group names refer to special operations, surveillance, forensics, or undercover work.
DHS says it is investigating a potential breach and taking steps to protect workers. The group that published the material says it came through a DHS Okta sign-on system. That path has not been established publicly. Reuters could not verify the full trove, although it corroborated some records and confirmed details with three employees. Okta says it has no evidence that its own systems or data were compromised. Those distinctions matter. “Data associated with an identity platform” is not the same claim as “the identity vendor was hacked.”
The practical risk is larger than a contact list, but it is not proof that passwords were exposed. Titles and group memberships can reveal how an organization is arranged, who works together, and which person might plausibly ask for access or an urgent transfer. That is excellent raw material for targeted phishing and impersonation. Small businesses should treat directory data and permission-group names as security information: limit who can browse them, use phishing-resistant multifactor authentication, monitor unusual sign-ins, and remove stale accounts and groups. For most readers there is no immediate action. Affected DHS personnel should follow official guidance and be skeptical of messages that use correct workplace details to manufacture trust.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
Chrome can now pull form answers from Gmail
Google is extending Chrome’s enhanced autofill so it can suggest order numbers, package tracking details, and flight bookings found in Gmail. The feature is rolling out in the United States on desktop, Android, and iOS for users 18 and older who have opted into Gemini Personal Intelligence. Photos data is planned later. That is more useful than retyping a reservation code, and it is also another permission boundary worth understanding.
This is not Chrome automatically reading every Gmail account. It depends on the Personal Intelligence connection and Chrome’s enhanced autofill setting. In Chrome, the path is Settings, Autofill and passwords, Autofill settings, then “Find and fill with Gemini.” Google says users can open the source email behind a suggestion and remove the suggestion. Removing it from Chrome does not delete the email; deleting the source email removes the suggestion. Sensitive fields require reauthentication by default, and administrators can control enhanced autofill through enterprise policy.
If you use a shared computer, manage employee devices, or simply prefer a smaller data surface, check the setting instead of assuming the default fits you. The feature may save time without being appropriate on every browser profile. It is part of the same larger shift we covered when Google’s AI connections began shaping more personalized services: convenience increasingly comes from letting one product retrieve context from another. The important question is not whether the feature is “AI.” It is which account data it can reach and whether that permission still makes sense.
Turning on AI is the easy part
Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.
Your existing Google Ads campaign can enter an AI conversation
Google is also expanding ads inside AI Mode. Ads are now eligible in ten additional markets, and multiturn ads are launching in the United States. Multiturn means the sponsored result can respond to the context built during a conversation, not only the first query. Google says paid placements remain labeled “Sponsored” and do not influence the organic AI response.
For small-business advertisers, the important detail is that there is no separate AI Mode campaign to turn on. Existing Search, Shopping, and Performance Max campaigns can become eligible automatically. Advertisers cannot target AI Mode by itself, opt out of it separately, or see a clean AI Mode performance report because reporting remains aggregated. Google may also generate an AI explanation of why an ad is relevant, and the advertiser cannot edit, approve, or disable that explanation.
That makes boring campaign hygiene more important, not less. Review negative keywords, product feeds, landing-page claims, conversion tracking, and the queries your campaigns already attract. If the underlying information is sloppy, putting it into a conversational interface does not make it smarter. It just gives the system more polished ways to present the same mistake. Consumers should keep watching for the Sponsored label, especially when the placement feels like a continuation of the assistant’s answer rather than a familiar block of search ads.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources and further reading
- Associated Press: New York’s AI companion protections for minors and enforcement details.
- New York State Senate: AI Companion Model Safety Act.
- New York State Senate: security requirements for internet-connected baby monitors.
- Reuters: DHS personnel-data publication, corroboration, and responses.
- Wired: additional reporting on the exposed DHS records.
- Google: Chrome enhanced autofill announcement.
- Google Chrome Help: settings, source review, removal behavior, and controls.
- Google: international expansion and multiturn ads in AI Mode.
- Google Ads Help: campaign eligibility, reporting, opt-out limits, and AI-generated explanations.
- Photo by Vitaly Gariev on Pexels.
