Relevant Law
SAFE for Kids Act Implementing Rules, 13 NYCRR § 700
Effective date:
January 25, 2027, 180 days after the publication of Final Rule implementing the Act.
Age in Scope
Minors < 18
Companies in Scope
Social media platforms that offer or provide users an “addictive feed” as a significant part of the services.
An “addictive feed” is an online service where user content is recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user’s device, absent certain exceptions.
Key Exceptions
It is not an addictive feed if the recommendation, prioritization or selection of content is: based on information not persistently associated with the device or the user’s previous interactions; based on privacy settings or technical device information; selected because the user requests to follow the creator or poster of media or subscribed to a page or group; in response to a specific search inquiry; direct and private communications; or presented in a pre-existing sequence from the same author, creator, poster or source.
Age Verification Mechanism
Before providing an addictive feed, the operator must use commercially reasonable and technically feasible methods to determine that the user is not a minor < 18, or (b) the operator has obtained verifiable parental consent to provide an addictive feed to a minor.
The AG shall promulgate regulations identifying commercially reasonable and technically feasible methods to determine if user is a minor, and to obtain verifiable parental consent.
Key Requirements
Prohibited from:
- Providing an addictive feed to a minor <18 without parental consent
- Sending overnight notifications to a minor between the hours of 12-6 AM without parental consent
- Discriminating by degrading the quality or increasing the price for users to whom the operator cannot display an addictive feed
- Operator must provide instructions to parents in 12 languages commonly spoken in New York
Enforcement & Penalities
- Enforced by the AG
- AG may seek civil penalties up to $5,000 per violation, as well as restitution, disgorgement, destruction of unlawfully obtained data, damages, and other relief the court deems proper
- No private right of action
Relevant Law
New York Child Data Protection Act, AB 8149/SB 7695, N.Y. Gen. Bus. Law. §§ 899-ff through 899-mm
Effective date:
June 20, 2025
Age in Scope
Minors < 18
Companies in Scope
Operator that provides a website, online service, mobile app or connected device (a) that has actual knowledge a user is minor < 18, or (b) where the website, online service, mobile app or connected device is primarily directed to minors.
Key Exceptions
None specified.
Age Verification Mechanism
None. Actual knowledge standard.
Operator must respect age signals sent from device, including through a browser plug-in, privacy setting or device setting that complied with AG promulgated regulations.
Key Requirements
- Purpose specification. May process Minor’s personal data only if the processing is strictly necessary for enumerated permissible purposes, or the operator obtains verifiable parental consent (for minors <13) or informed consent from the minor (minors 13-18)
- Consent for advertising, marketing, research and development and data sales
- Must inform third parties that user is a minor or that service is directed to minors
- Compliance obligations for Processors
Enforcement & Penalties
- Enforced by the AG
- AG may seek civil penalties up to $5,000 per violation, as well as restitution, disgorgement, destruction of unlawfully obtained data, damages, and other relief the court deems proper
- No private right of action
Relevant Law
Safe by Design Act, S9008c, N.Y. Gen. Bus. Law. §§ 1539-1547
Effective Date:
January 1, 2027
Age in Scope
Minor < 18, as determined by the operator via age assurance
Companies in Scope
“Covered platform” means an website, app or online service that: allows users to construct a public or semi-public profile and offers or provides the following features:
(i) a mechanism to allow users to communicate privately with each other within the service or through platform integration with a separate website, service, or application; and
(ii) either (A) a mechanism to create or post media that is viewable by other users and to respond to such media, including through a landing page or feed that presents the user with USC created by other users; or
(B) a mechanism: (1) to create games or immersive digital environments for other users or to play online games; and (2) to make in- game purchases using money or to exchange money for digital currency.
Applies to conduct that occurs in New York, potentially applicable to residents of other states who access the Covered Platform in New York.
Key Exceptions
None specified.
Age Verification Mechanism
Age Assurance required for a user to communicate privately, view full profile of a user, respond to or download media created by other users, tag a user, view the geographic location information of a user, or access an integrated AI companion.
AG will promulgate regulations for age assurance mechanism. Until then:
“Age assurance” shall mean reasonable and technically feasible
methods to determine the age of a user, but (i) cannot rely on self-declared age; (ii) must provide more than one age assurance method, at least one which does not require gov’t ID or that allows users to maintain anonymity.
Can rely on age assurance regulations to be made for the NY Safe for Kids Act, when available.
Key Requirements
By default for Minors:
- Cannot allow a user over 18 who is not already connected with a minor to: (i) privately communicate with Minor; (ii) view the full profile of Minor; (iii) respond to or download media posted by Minor; (iv) tag Minor in media; (v) view geographic location information of Minor.
- Access to an integrated AI companion must be disabled
Must build mechanism for parents to:
- Override or maintain default settings separately
- Respond to request from Minor to override default setting
- Set monthly spending limits, view history of transactions
- For Minors <13, consent to each connection to other user and view list of connected users;
- For Minors 13<18, view each covered platform that requested integration
Enforcement & Penalties
- Enforced by the AG.
- AG may seek civil penalties up to $5,000 per violation, as well as restitution, disgorgement, destruction of unlawfully obtained data, damages, and other relief the court deems proper.
- No private right of action.
The AG shall promulgate implementing Rules.
The AG shall maintain a website to receive complaints, information and referrals from the public.
Relevant Law
Warning Labels for Addictive Feature Platforms, SB 4505, N.Y. Gen. Bus. Law. §§ 1520-1526
Effective Date:
January 1, 2027
Age in Scope
Minors < 17
Not required to display warning label if platform has reasonably determined the user is over 17
Companies in Scope
“Addictive feature platform” means a social media platform which offers or provides covered users an addictive feed (as defined in the SAFE for Kids Act), autoplay and/or infinite scroll as a significant part of the services provided by the social media platform.
Key Exceptions
Does not apply to conduct wholly outside of New York, e.g., if the addictive feature platform is accessed by a user who is physically located outside of New York.
Age Verification Mechanism
None specified. The platform is not required to display the warning label if it has reasonably determined the user is over 17.
Key Requirements
Warning label text:
“The Surgeon General has warned that while social media may have benefits for some young users, excessive use may be associated with significant mental health harms.”
Display warning label:
- Daily. Each day at the time the user accesses the addictive feature platform; display label for 10 seconds taking up at least 25% of the screen.
- Time limits. After 3 hours of cumulative active daily use; display label for 30 seconds taking up at least 75% of the screen.
Enforcement & Penalties
- Enforceable by Attorney General.
- Civil penalties of $5,000 per violation, plus injunction, restitution, disgorgement of profits or damages.
- No private right of action.
- Attorney General shall maintain a website for complaints of violations.
Relevant Law
Companies & Material in Scope
“AI companion” means a system using artificial intelligence, generative artificial intelligence, and/or emotional recognition algorithms designed to simulate a sustained human or human-like relationship with a user by:
(i) retaining information on prior interactions or user sessions and user preferences to personalize the interaction and facilitate ongoing engagement with the AI companion;
(ii) asking unprompted or unsolicited emotion-based questions that go beyond a direct response to a user prompt; and
(iii) sustaining an ongoing dialogue concerning matters personal to the user.
“AI companion” shall not include:
(i) any system used by a business entity solely for customer service or to strictly provide users with information about available commercial services or products provided by such entity, customer service account information, or other information strictly related to its customer service;
(ii) any system that is primarily designed and marketed for providing efficiency improvements or, research or technical assistance; or
(iii) any system used by a business entity solely for internal purposes or employee productivity.
Notifications
Provide a clear and conspicuous notification to a user at the beginning of any AI companion interaction which need not exceed once per day and at least every three (3) hours for continuing AI companion interactions which states either verbally or in writing that the user is not communicating with a human.
Harm Reduction
Must have a protocol to take reasonable efforts for detecting and addressing suicidal ideation or expressions of self-harm expressed by a user to the AI companion, that includes detection of user expressions of suicidal ideation or self-harm and a notification to the user that refers them to crisis service providers such as the 9-8-8 suicide prevention and behavioral health crisis hotline, a crisis text line, or other appropriate crisis services upon detection of such user’s expressions of suicidal ideation or self-harm.
Protections for Minors
None
Enforcement & Penalties
Enforceable by AG.
AG may bring an action for injunction and may seek civil penalties up to $15,000 per day for a violation of 1701 or 1702 and may seek other remedies as court deems appropriate.
Relevant Law
New York Safe by Design Act, S9008c, N.Y. Gen Bus. Law §§ 1539-1547 (certain provisions)
Effective date: January 1, 2027
Applies to:
- AI companions that are part of a Covered Platform
- minors < 18 only
Companies & Material in Scope
Only applies to certain types of Covered Platforms that have an integrated AI Companion.
Covered platform means a website, app or online service that allows users to construct a public or semi-public profile and offers or provides the following features: (i) a mechanism to allow users to communicate privately with each other; and (ii) either (A) a mechanism to create or post media that is viewable by other users and to respond to such media, including through a landing page or feed that presents the user with USC created by other users; or (B) a mechanism: (1) to create games or immersive digital environments for other users or to play online games; and (2) to make in- game purchases using money or to exchange money for digital currency.
Integrated AI Companion has same definition as NY Gen Bus Law § 1701, with an additional exception to exclude an artificial intelligence system or non-player character (NPC) that operates exclusively within a game or immersive digital environment, provided that such system’s interactions are strictly constrained to the fictional context of such game or environment and do not initiate, encourage, or sustain dialogue concerning the user’s real-world life, emotional state, or personal affairs.
Notifications
N/A
Harm Reduction
N/A
Protections for Minors
Must conduct age assurance before allowing access to an Integrated Ai Companion.
For minors <18:
- The access or use of an Integrated Ai Companion must be disabled by default. Default may be overridden or maintained by parent.
- Must build a mechanism to request parental consent when Minor requests access.
Notice to parent must include a statement that informs the parent that the parent is being asked to provide consent to change a default setting required under New York law. The parent may thereafter provide or withhold such consent.
Enforcement & Penalties
Enforceable by AG.
The AG may bring an action to seek civil penalties of up to $5,000 per violation, injunction, restitution, disgorgement, damages caused directly or indirectly by violation, or other relief deemed proper by court.
The AG shall maintain a website to receive complaints, information and referrals from members of the public concerning the operator’s alleged noncompliance.
U.S. Online Safety Law Tracker
U.S. states are passing legislation to protect children’s online safety at a rapid pace, from novel legislation aimed at protecting minors on social media, gaming platforms and other online services, to providing teens additional consent rights and data protections, and protecting minors from harmful content. Below is a state-by-state law tracker to help businesses stay informed and navigate the evolving online safety legislative landscape. The tracker provides a bird’s-eye view of the various state online safety, privacy and harmful content laws that have passed, along with their effective dates, scope, key requirements, penalties and more. We will update the tracker periodically to reflect new legislation and key changes to existing laws.
Click on individual states to explore.
Last updated August 31, 2026
Information is only shown for states with defined laws to-date.
Please note that these laws are in flux and subject to change; additional details in the statutes, other sources of interpretation, and local laws in cities and counties may also apply.
Visit the Online Safety Law Center
We help clients navigate the risks of child and student data collection and use by designing age-appropriate features and tools to ensure user safety and manage legal and reputational concerns.