New York’s Final Rules For Kids Set A New Benchmark For Age Assurance

On July 28, 2026, the New York Attorney General released final rules implementing the SAFE for Kids Act. The rules clarify which platforms are covered, how covered platforms must determine whether users are adults (18 or older), and how they may obtain parental consent before providing minors with personalized feeds or late-night notifications.

The age assurance provisions are particularly significant. Rather than mandating a specific technology, the rules establish a detailed framework for evaluating whether age assurance methods are sufficiently accurate, reliable, and privacy-protective. In doing so, they provide important insight into how New York expects platforms to approach age assurance and may influence how similar requirements are interpreted or implemented in other states.

The rules take effect on January 25, 2027, giving covered platforms approximately six months to develop and test their compliance programs. Although the law is aimed primarily at features commonly associated with large social media platforms, any online service that prominently offers personalized feeds of user-generated content should assess whether it falls within the scope of the rules.

The SAFE Act for Kids

The SAFE for Kids Act applies to operators of addictive social media platforms, which are platforms that offer an addictive feed as a significant part of its services. At a high level, an addictive feed is a feed of user-generated or user-shared content that is personalized using information associated with the user or device, including the user’s previous interactions with media generated or shared by other users. The definition generally excludes chronological feeds and content from accounts, groups, or other sources that a user has expressly chosen to follow or subscribe to. The final rules establish that addictive feeds are a significant part of the services provided by an online platform if 20% or more of time spent by monthly active users is spent on addictive feeds.

The Act imposes two principal restrictions. First, a platform may not provide an addictive feed to a New York user unless it has determined through a compliant age-assurance method that the user is an adult or, if the user is a minor, has obtained verifiable parental consent. Second, a platform may not send a minor notifications between midnight and 6:00 a.m. without verifiable parental consent.

Importantly, the absence of parental consent does not permit a platform to exclude the minor from the service altogether. Instead, the platform must allow the minor to access available content without the addictive feed.

Age Assurance Requirements

The centerpiece of the final rules are the age-assurance requirements. The rules establish three broad age assurance categories: (i) age estimation; (ii) age inference; and (iii) age verification. Platforms may choose among these categories to determine whether a user is an adult or a minor, subject to certification, accuracy, and other performance requirements. These categories are defined at a high level, and the rules provide few concrete examples, but the AG’s rulemaking materials provide additional context about the types of methods each category was intended to encompass.

• Age estimation means analyzing a physical or behavioral characteristic to determine whether a user is likely to be an adult or a minor through, for example, a selfie, short video, or audio recording.
• Age inference uses verified information other than a direct statement of age to reach a conclusion about whether the user is an adult. This information could include existing platform activity or information associated with a validated email address or cell phone number.
• Age verification is the most direct approach. It confirms age through generally accepted identification or an official records source. The final rule expressly refers to government-provided identification but does not list particular documents. Driver’s licenses and passports are clear examples, and other authoritative documents or government records may also qualify.

The rules also focus on whether an age assurance method produces sufficiently reliable results, rather than prescribing how the method must work. They establish maximum error rates for incorrectly classifying minors as adults, with stricter limits for younger children and progressively greater tolerance as users approach 18. For example, the maximum permitted error rate is 1% for children 8-13 and 15% for 17-year-olds. Each age-assurance method must be tested and certified annually by an accredited third party. Testing must address accuracy, inconclusive results, and resistance to circumvention. Platforms must retain the underlying test results, reports, and certifications for at least 10 years.

Parental Consent

Guidance is provided on obtaining parental consent when a minor seeks access to an addictive feed or other restricted features. Before contacting a parent, a platform must tell the minor that parental consent is legally required and obtain the minor’s consent to initiate the parental-consent process.

The rules specify what the parent facing notice and consent process must include. Among other things, the platform must identify itself, inform the parent the service can be accessed without an addictive feed, and use a consent method that is reasonably calculated, in light of available technology, to ensure that the person providing consent is the minor’s parent. Note that COPPA verifiable parental consent requirements will be considered as sufficient in certain circumstances.

More generally, platforms must review their parental-consent methods at least annually and update them as appropriate to reflect changes in available technology.

Conclusion

Companies with feeds should consider if the Act applies to them, even if they have not traditionally identified themselves as a social media company. Businesses should identify feeds containing user-generated content, determine what information drives ranking and recommendations, and measure how much user time is spent in those feeds.

Even companies that fall outside of the Act should compare their age assurance and notice and consent practices against the final rule, particularly where they are subject to other laws that require age estimation, assurance, or verification.