New York Attorney General Letitia James, together with Governor Kathy Hochul, released the final rules implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act. The rules establish concrete standards for how social media platforms must restrict algorithmically personalized feeds and nighttime notifications for users under 18, unless they obtain verified parental consent.
The SAFE for Kids Act is one of the strongest state-level efforts in the country aimed at reducing the mental-health harms linked to addictive social media design. It goes into effect on January 25, 2027 — 180 days after the final rules are published in the State Register.
This post breaks down the key requirements, who is covered, how age assurance and parental consent must work, the penalties for non-compliance, and what platforms should be doing now to prepare.
Background: Why New York Passed the SAFE for Kids Act
Signed into law by Governor Hochul in June 2024, the SAFE for Kids Act targets two design features that research has linked to higher rates of depression, anxiety, eating disorders, and sleep problems in children and teenagers:
- Algorithmically personalized (“addictive”) feeds — endless streams of content recommended on the basis of user data, often from accounts the user does not follow and presented out of chronological order.
- Nighttime notifications — push notifications sent between 12:00 a.m. and 6:00 a.m.
The law does not ban under-18 users from social media. Instead, it requires platforms to default to non-addictive experiences (for example, chronological feeds limited to accounts the user follows or selects) unless a parent affirmatively consents to the addictive version. Users who do not receive parental consent, or who choose not to seek it, must still be able to access the platform and its content.
Who Must Comply?
The rules apply to “Addictive Online Platforms.” These are platforms that:
- Display user-generated content, and
- Have users who spend at least 20% of their time on the platform’s addictive feeds.
This definition focuses on platforms whose core engagement model relies heavily on algorithmic recommendation systems.
Age Assurance Requirements
Platforms must determine that a user is 18 or older before allowing access to addictive feeds or nighttime notifications. The final rules set several important standards:
- Companies may use any existing age-assurance method (uploaded image/video, email or phone verification cross-checked against other data, etc.) as long as the method meets defined accuracy benchmarks and protects user data.
- Platforms must offer at least one alternative method that does not require a government-issued ID.
- Data collected for age assurance or parental consent may be used only for that purpose. It must be deleted or de-identified immediately after its intended use, and platforms must collect only the minimum amount of data necessary.
- Minors must have a clear way to update their age status when they turn 18.
- Platforms must choose methods with high accuracy rates, conduct annual testing, and retain the testing results for a minimum of 10 years.
These provisions reflect a deliberate attempt to balance effectiveness with privacy protections, particularly for vulnerable groups such as LGBTQIA+ youth and immigrant communities who may face heightened risks from identity-linked verification.
Parental Consent Process
The rules carefully structure how consent must be obtained:
- A minor must affirmatively request access to the restricted features and must consent to their parent being notified.
- Any parent granting consent must themselves complete age assurance.
- Platforms cannot block a minor from general access to the platform or its content (including search) simply because parental consent was refused or not obtained.
- Platforms are not required to show parents a user’s search history or topics of interest as a condition of consent.
- Both parents and minors must be able to withdraw consent at any time.
This design aims to prevent platforms from using the consent requirement as a de facto lockout while still giving parents meaningful control over the highest-risk features.
Enforcement and Penalties
The New York Attorney General’s Office is authorized to bring actions to stop violations and to seek civil penalties of up to $5,000 per violation, among other remedies. Given the private-right-of-action trends seen in other privacy statutes, platforms should also expect heightened scrutiny and potential follow-on litigation once the law is in effect.
Related New York Law Already in Force
In the same legislative package, New York enacted the Child Data Protection Act, which prohibits online platforms from collecting, using, sharing, or selling the personal data of anyone under 18 unless they receive informed consent or the processing is strictly necessary for the purpose of the service. That law is already in effect and works alongside the SAFE for Kids Act.
What Platforms Should Be Doing Now for SAFE for Kids Act Compliance
With the effective date set for January 25, 2027, covered platforms have a clear runway — but the technical and operational work is substantial:
- Inventory current feed architecture and notification systems to identify what qualifies as an “addictive feed.”
- Select and validate age-assurance methods that meet the accuracy, privacy, and alternative-method requirements.
- Design consent flows that are affirmative, revocable, and do not condition general platform access on consent.
- Build data-minimization and deletion processes for age and consent data.
- Establish annual testing and record-retention programs for age-assurance methods.
- Review how the New York Child Data Protection Act interacts with the new feed and notification restrictions.
Key Dates
- July 28, 2026 — Final rules released by Attorney General James
- July 29, 2026 — Rules published in the State Register
- January 25, 2027 — SAFE for Kids Act takes effect
New York’s final SAFE for Kids Act rules
New York’s final SAFE for Kids Act rules represent one of the most detailed state-level attempts to regulate addictive design features on social media while still preserving access and incorporating privacy safeguards. Platforms that operate algorithmic recommendation systems and serve New York users should treat the January 2027 effective date as a hard compliance deadline.
At Captain Compliance, we help organizations track emerging state privacy and children’s online safety requirements, assess their exposure, and build practical compliance programs. If your platform needs to evaluate how the SAFE for Kids Act and related New York laws apply to your products, we are available to assist.