New York says companies can't trap customers in chatbot loops when they want to cancel

New York City's Department of Consumer and Worker Protection (DCWP) has said companies may not use chatbots to trap customers in endless loops when they are trying to cancel a subscription or dispute a charge ^[1].

The announcement, made in a short video on Facebook, applies existing consumer protection law to AI customer service. It doesn't create new rules, but it makes clear that a chatbot cannot be used to make it harder for someone to exercise a legal right.

Think of it like this: if a company wouldn't be allowed to send you round in circles on the phone, it can't do it with a chatbot either. The technology changes, the obligation doesn't.

What DCWP says

In the video, DCWP's commissioner states that companies must provide a clear way for customers to cancel subscriptions, dispute charges and speak to a human when they need to ^[1]. A chatbot that blocks those actions, or makes them unnecessarily difficult, breaks the law.

The announcement follows reports of customers stuck in chatbot conversations that offered no way out, no escalation and no human contact. One pattern that has drawn complaints is the chatbot that answers every request to cancel with another question, or sends the customer back to the start.

DCWP enforces New York City's Consumer Protection Law, which prohibits deceptive and unfair trade practices. That law already covered obstruction and delay. What the announcement does is make explicit that obstruction by chatbot counts.

What this means for you

If you run a chatbot that handles cancellations, refunds or disputes, here are four questions to ask:

• Can a customer who wants to cancel get to a cancellation form, or to a human, in two steps or fewer?
• Does the chatbot offer an escalation path when it can't resolve something?
• Are you logging what the chatbot says, in case a customer later disputes what happened?
• If a customer turns up with a screenshot of the chatbot promising something you don't think you offered, do you have your own record of that conversation?

The last question is the evidence question. A customer's screenshot can become the only record of what the chatbot said, and that puts you on the back foot.

When the customer has the only record

A screenshot is easy to take and hard to argue with. If a chatbot tells someone they can cancel for free and they keep the picture, that picture is evidence. Whether you meant the chatbot to say that, or whether your terms allow it, becomes a separate question.

In a 2024 case in British Columbia, a customer asked an airline's chatbot about bereavement fares and got the wrong answer. The customer screenshotted it. When the airline later said it wouldn't honour the fare, the tribunal ordered it to pay ^[2]. The airline had no record to show what the chatbot actually said, so the screenshot stood.

That case was about what the chatbot promised. DCWP's point is simpler: if the chatbot is blocking customers from doing something they have a right to do, that's a problem now, before anyone takes a screenshot.

Sealing what the chatbot says

Here is where a digital witness fits. The thing to seal is each answer the chatbot gives, or each full conversation when it closes. You seal a fingerprint of the exchange, not the content itself, so the conversation stays in your systems. If a customer later disputes what was said, anyone you share the record with can check that it hasn't changed since it was sealed.

Sealing happens through WitniumChain's REST API, SDK or MCP server. The first 2,000 witnesses a month are free.

What it shows is that the record you kept is exactly what was written at the time. It doesn't prove the answer was correct, or that you are legally bound by it. Those are separate questions. But it does mean you have your own checkable record, not just the customer's screenshot.

How it would work

1. Your chatbot system sends a fingerprint of each answer, or of the full conversation at the end, to WitniumChain.
2. You get a witness ID back, stored alongside the conversation in your database.
3. When a customer disputes what the chatbot said, you share the sealed record. They can check the fingerprint themselves.

What it doesn't do is authorise what the chatbot said, make a wrong answer right, or replace proper access to a human when someone needs one.

Under the AI Act

In the EU, Article 50 of the AI Act requires that people interacting with an AI system must be told that they are doing so, unless it is obvious from the context ^[3]. That rule has applied since 2 August 2026. The disclosure must happen before or at the start of the interaction.

The Article also requires users of emotion recognition or biometric categorisation systems to tell the people affected. For deepfakes, the person publishing them must say they are AI-generated, and for AI-generated text that is published to inform the public and hasn't been reviewed and vouched for by a person, a disclosure is required too ^[3].

What Article 50 doesn't require is a record of what the AI said. That is a separate question, and the answer depends on your sector and your risk. But knowing that someone was talking to an AI is one thing; being able to show what it actually told them is another.

What to watch

New York's announcement is local, but the pattern isn't. Consumer protection authorities in other jurisdictions enforce similar rules against obstruction, and AI in customer service is on their agenda.

In the EU, the Unfair Commercial Practices Directive already prohibits aggressive practices that restrict a consumer's freedom of choice, and national enforcement bodies are starting to look at how chatbots are used ^[4]. The AI Act's transparency requirement adds another layer: if people have a right to know they are talking to an AI, they probably also have a right to a way out when the AI can't help.

If you use AI to talk to customers, the question is not whether regulation is coming. It is whether your systems can show, if asked, that they respect the rights customers already have.

Sources

1. Companies cannot trap consumers in endless chatbot doom loops, New York City Department of Consumer and Worker Protection, Facebook video, January 2025. https://www.facebook.com/helloDCWP/videos/2105122113476653/
2. Moffatt v. Air Canada, 2024 BCCRT 149, Civil Resolution Tribunal of British Columbia, 14 February 2024. https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do
3. Article 50 of Regulation (EU) 2024/1689, EU AI Act, European Commission AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
4. Directive 2005/29/EC on unfair commercial practices, EUR-Lex. https://eur-lex.europa.eu/eli/dir/2005/29/oj