On May 9, 2025, New York Governor Kathy Hochul signed Assembly Bill A3008 into law. The omnibus legislation mandates transparency in personalized algorithmic pricing while prohibiting related discrimination. The new law also requires operators of AI companions to implement safety protocols and disclose bot usage to consumers. The requirements take effect July 8 2025 and November 5, 2025, respectively.
Personalized Algorithmic Pricing
Key Terms Under the New Law
• “Dynamic pricing” means pricing that fluctuates dependent on conditions.
• “Personalized algorithmic pricing” means dynamic pricing derived from or set by an algorithm that uses consumer data (i.e, data that identifies or could identify the person making a purchase or lease of goods or services).
Restrictions
A3008 amends New York’s deceptive acts and practices law to prohibit any person from knowingly offering personalized algorithmic pricing specific to a particular individual without a clear and conspicuous disclosure stating, “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.”
A3008 also prohibits the use of protected class data to set prices for any good or service if (i) the use of the data causes the withholding or denial of any accommodations, advantages and privileges accorded to others, or (ii) the price of such goods or services is different from the price offered to other individuals or groups based on the use of protected class data.
Penalties for failure to provide notice in connection with personalized algorithmic pricing include (1) regulatory civil fines of up to $5,000 per violation, and (2) private claims for $50 or actual damages, whichever is greater. In addition, if the violation was committed willfully or knowingly, courts may award treble damages for private claims, up to a maximum of $1,000.
For violations related to the use of protected class data, an individual may bring a claim under New York’s Human Rights Law. The New York State Division of Human Rights may impose a range of penalties, including (1) compensatory damages awarded to the individual and (2) a maximum civil fine of $50,000 – $100,000 for willful, wanton or malicious violations – payable to the state.
The personalized algorithmic restrictions take effect July 8, 2025.
AI Companions
Key Terms Under the New Law
• “AI companion” is a system that uses artificial intelligence or emotional recognition algorithms (i.e, AI that detects and interprets human emotion) to “simulate social human interaction, by retaining information on prior interactions and user preference, asking questions, providing advice, and engaging in simulated conversations on matters of personal well-being.”
• “Operator” means any person or business entity who operates or provides an AI companion.
Requirements
Operators must implement protocols in AI companions to respond to user expressions of suicidal ideation or self-harm. The protocols must include, at a minimum, a notification referring users to crisis service providers, such as a suicide hotline or other crisis services.
Operators are also required to notify users that they are communicating with a bot at the beginning of an AI companion interaction and at least once every three hours during ongoing interactions. The notification must verbally or in writing state: “THE AI COMPANION (OR THE NAME OF THE AI COMPANION) IS A COMPUTER PROGRAM AND NOT A HUMAN BEING. IT IS UNABLE TO FEEL HUMAN EMOTION.”
Operators that violate these requirements may be subject to private enforcement as users may sue for damages, equitable relief and other remedies as the court may deem appropriate.
The requirements for operating and providing AI companions take effect November 5, 2025.
Continue to follow alstonprivacy.com for more information on AI legislative and regulatory developments and contact us for more information.
