AI & Tech Policy · Cyber Law · Platform Governance

Anna Viñals Musquera

AI Policy Researcher & Cyber Legal Associate

Mapping the rules that govern AI — from state legislatures to congressional testimony — with the legal depth to know how they'll be enforced.

AI policy, grounded in law.

I research how emerging technology regulation shapes platform accountability and digital safety — with a particular focus on AI governance, age assurance, Section 230 reform, and online expression law. At NYU's Center on Technology Policy, I serve as Senior Policy Analyst and Head of Online Expression and Safety, where I track state and federal AI legislation, produce research that reaches policymakers, and translate complex legal frameworks into actionable analysis.

My research has been published on Lawfare, cited in U.S. Congressional and House of Representatives materials on AI consumer protection, and presented to government stakeholders. I also bring six years of practice at international law firms advising on regulatory, privacy, and cross-border technology matters — and hands-on experience with cyber-enabled fraud research at the National Cyber Forensics and Training Alliance.

I hold an international J.D., an LL.M. in International Law, and a Master of Science in Global Security, Conflict, and Cybercrime from New York University.

AI Regulation Platform Governance Age Assurance & Child Safety Section 230 & Online Expression Cyber Law & Litigation EU & U.S. Data Protection Cross-Border Cyber Matters IP & Regulatory Compliance
NYU Center on Technology Policy
Senior Policy Analyst & Head of Online Expression and Safety

State and federal AI regulation, platform accountability, age assurance, and digital safety research.

Next Peak
Cyber Legal Associate

High-stakes IP, regulatory, and cross-border cyber matters across U.S. and EU frameworks.

NCFTA
Cybercrime & Tech Policy Researcher

Applied research on cyber-enabled fraud, presented to 200+ law enforcement & government participants.

Selected Work

Talks & Appearances

🎙️
Webinar · NYU Center on Technology Policy
The Surge of State AI Companion Bills: How States Are Regulating AI Companions
April 29, 2026

A discussion on one of the fastest-moving areas of state tech policy: AI companion and chatbot legislation. The webinar examined how states are defining AI companions, where legislative approaches are converging or diverging, and what evidence is still needed as lawmakers move from disclosure-focused proposals toward more complex questions of design, safety, liability, age assurance, and human-AI relationships. Featuring state legislators from Utah and Washington, along with policy advisors and academic experts.

▶ Watch the recording →
Congressional Citation
AI Consumer Protection Research

Research cited in U.S. Congressional and House of Representatives materials on AI-related consumer protection issues

Research Presentation
Cyber-Enabled Fraud & Technology Regulation

National Cyber Forensics and Training Alliance — ~200 participants across law enforcement, government & private sector

Available For
Panels, Podcasts & Keynotes

AI regulation · Platform governance · Online safety · Age assurance · Section 230 · EU–U.S. cyber frameworks

Commentary & Analysis

Short, direct analysis of AI and tech regulation as it happens — from new state bills to the gaps in existing law. I write here about what I'm tracking in my research at NYU CTP and in practice.

June 2026  ·  AI Regulation  ·  Platform Governance

States Don't Know What an AI Companion Is — and They're Regulating It Anyway

Nearly 100 chatbot bills tracked across U.S. states, and the definitional problem is still unsolved. Here's what that means for enforcement — and for users.

In the first two months of 2026, nearly 30 U.S. states introduced almost 60 bills targeting AI companions and chatbots. By late April, we were tracking nearly 100. That pace — roughly one new bill every other day — tells you something important: legislators are moving fast on something they haven't fully defined.

I know this territory well. At NYU's Center on Technology Policy, I've spent months tracking these proposals, and in April I hosted a webinar with state legislators from Utah and Washington, a TechNet state AI policy advisor, and an academic who studies human-AI relationships. We spent an hour on a deceptively simple question: what is an AI companion, and what should the law do about it?

We left without a clean answer. That's not a failure — it's the honest state of play.


The definition problem is the regulation problem

Before you can regulate something, you have to define it. And "AI companion" is doing a lot of work right now as a legal category.

Some bills target any AI system capable of forming an ongoing relationship with a user. Others focus narrowly on romantic or emotional AI applications. Some rope in customer service chatbots with persistent memory. A few are so broad they'd arguably cover AI tutors, mental health apps, and voice assistants.

This matters enormously at the enforcement stage. Vague definitions mean industry lawyers can argue their product falls outside the law. Overly narrow definitions get gamed by a simple name change. And when the line between "companion" and "productivity tool" is set by a legislature that hasn't deeply engaged with how these products actually work, you get laws that are simultaneously over- and under-inclusive.

The Utah and Washington legislators on our panel were thoughtful about this — both acknowledged that their states' approaches had evolved quickly and that definitional clarity was still a live debate. These aren't lawmakers writing bad-faith bills; they're trying to address real harms in real time with imperfect tools.


Disclosure was just the beginning

Early AI companion legislation focused on disclosure: tell users they're talking to an AI, and you've done your job. That window has already closed.

The bills we're tracking now go much further — into product design, mandatory reporting obligations, private rights of action, age assurance requirements, and liability for psychological harm. This moves regulation from "what must you tell users?" to "what are you allowed to build?"

Design regulation is genuinely hard. When a state says an AI companion must not be "designed to foster emotional dependency," it's asking companies to prove a negative — and asking courts to evaluate the internal architecture of AI systems that most judges and legislators have never seen. That doesn't mean it's the wrong goal. The instinct to go beyond disclosure is correct. The execution is what needs work.


What's actually at stake

The federal vacuum is driving state action. Congress has not passed comprehensive AI legislation. States are filling that gap. Some of what they're doing is thoughtful and evidence-based. Some is reactive. The result will be a patchwork that's costly to comply with and inconsistent in how it protects users across state lines — and it creates strong pressure for federal preemption, which may ultimately leave users with weaker protections than the states were trying to provide.

Age assurance is the thread that connects everything. Child safety concerns are the political engine behind most of this legislation. That's understandable — but it means age verification requirements are being layered onto AI companion regulation in ways that import all of the existing problems with age assurance: accuracy, privacy, cost, disparate impact. We need to get age assurance right as a general matter before bolting it onto every emerging technology category.

The evidence base is thin. Lawmakers are moving faster than researchers. We know AI companions can form psychologically significant relationships with users — particularly vulnerable users and minors. What we don't yet have is systematic empirical evidence about prevalence, harm severity, or which design features drive the worst outcomes. Legislation is outrunning the data.


What I'd tell a policymaker

Start with disclosure and transparency — not because it's sufficient, but because it's foundational and defensible. Build your definitions with the enforcement agency in the room. Invest in the evidence base: commission research, require data reporting from large platforms. And coordinate with other states — the patchwork problem is real, and a multistate working group on AI companion definitions wouldn't solve everything, but it would at least mean companies aren't navigating 50 different legal regimes from scratch.


The surge of state AI companion legislation reflects a genuine concern about what it means to have emotionally significant relationships with AI systems — especially for young people. That concern is legitimate. The legislative response, so far, is incomplete: moving at the right speed, but not yet with the right precision.

I'll be watching this closely. If you're a policymaker, researcher, or practitioner working on AI companion regulation — I'd be glad to compare notes.

More posts coming

State AI bills Platform liability Age verification AI consumer protection Section 230 EU–U.S. frameworks

Follow on LinkedIn for updates as new posts land.

Follow on LinkedIn →

Get in Touch

I welcome speaking invitations, research collaborations, media inquiries, and professional connections. If you're working on something at the intersection of AI, law, and policy — reach out. I also offer free 30-minute consultations for policymakers, journalists, and researchers.

Free 30-min consultation
Book time with me
AI regulation · Platform governance · Cyber law · Policy strategy
Book a call →
💼
LinkedIn
🏛️
Research
⚖️
Legal Practice
Next Peak