New York Finalizes Rules For The SAFE For Kids Act

New York Attorney General Letitia James has released final rules for the Stop Addictive Feeds Exploitation (SAFE) for Kids Act. The law was signed in 2024, but the effective date was triggered by the release of these rules. Now that these rules have been released, the law will go into effect on January 25, 2027.

A platform is in scope when it is an “Addictive Online Platform.” Meaning, one that during any one six-month period in the previous calendar year had monthly active users who spent 20% or more of their time using the platform’s addictive feeds. If the platform meets that 20% time threshold, the law will apply if the platform has at least five million monthly active users, at least 20,000 monthly active users who are minors, or if minors are the platform’s primary users.

Under the SAFE Act, an “addictive feed” is one that automatically selects and shows high volumes of user-generated content. This might happen through a platform using information tied to an individual or their device or by looking at what the user previously clicked, watched, or liked. The following do not count as addictive feeds: (1) content presented based on a user’s privacy or accessibility settings; (2) content shown in response to a specific search; (3) posts from accounts or authors the user chose to follow; (4) posts shared to a group or page the user follows; (5) direct and private messages; and (6) content that is next in a pre-existing sequence from the same source.

Beginning January 25, the following is what will be required from those who are covered by the law:

• Addictive Feeds. The law will bar covered platforms from providing an addictive feed to a user unless the platform first verifies that the user is an adult or has gotten parental consent. Platforms will also be barred from sending notifications about an addictive feed between 12 AM and 6 AM Eastern time.
  
  
• Age Verification. To verify age, the law will require using reasonable and technically workable methods. This will be more than having a user check a box. Instead, companies will need to offer one or more methods certified by an approved third party. Verification methods might include a government ID Check. But, if a company uses this option, it must also offer at least one other method. Companies will need to recertify annually, and keep test results and certifications for at least 10 years.
  
  
• Parental Consent. To get parental consent, covered platforms will need to tell the minor that the company cannot legally provide the feed without a parent’s consent. Then, the platform will need to get the minor’s permission to contact their parent. Next, the platform will need to notify the parent and give the parent a verified way to consent. Once someone gives consent, the platform must provide a simple and easy way to revoke that consent. The rules specify that covered companies cannot punish users or parents for not consenting. This includes not taking away products or services or increasing their price.
  
  
• Data Minimization and Security. The law will prohibit using information collected to check a user’s age or to get parental consent for any other purpose. Additionally, that information will need to be immediately deleted, except as required by law. The rules will also require that platforms collect only the minimum data needed and use it only for compliance purposes. Under the rules, covered companies will also have to protect that information with industry-standard security measures, including encryption, and delete it as soon as it is no longer needed. Separately, the rules will require platforms to keep certain limited records about the age verifications they conduct.

Once in effect, the Attorney General will be authorized to take legal action against any person or company that violates the SAFE for Kids Act, but only after July 24, 2027. Violations will be subject to civil penalties of up to $5,000 per violation.

Putting It Into Practice: The adoption of these rules starts the clock to the effective date New York SAFE Act. It is also a reminder that states are not hesitating to move forward child-focused digital legislation. We expect to see more action from other states; and continued challenges to these laws.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.