Privacy & Cybersecurity Law Blog

On July 28, 2026, the New York Attorney General (“AG”) released final rules (the “Rules”) implementing the Stop Addictive Feeds Exploitation for Kids Act (“SAFE Act”). The Rules establish requirements for how social media companies must restrict addictive features on their platforms for users under the age of 18. The SAFE Act goes into effect on January 25, 2027, giving covered platforms approximately six months to develop and implement compliance programs.

As we previously reported, the SAFE Act was signed into law by New York Governor Kathy Hochul in June 2024 and prohibits covered social media platforms from providing algorithmically personalized feeds and nighttime notifications to users under 18 unless they obtain verifiable parental consent. The legislature charged the AG with promulgating rules to establish standards for age assurance and parental consent before the statute could take effect. The AG issued an advance notice of proposed rulemaking on August 1, 2024, published proposed rules on September 15, 2025, and incorporated public input and industry research to develop the final rules.

Key provisions of the Rules are discussed below.

Applicability 

The Rules interpret the statute’s “significant portion” standard to mean an online platform where 20% or more of time spent by monthly active users is spent on “addictive feeds,” measured over any six-month period.

An “addictive feed” is defined as an online platform, or a portion thereof, in which multiple pieces of media from an online platform are: (1) shared or generated by users; and (2) concurrently or sequentially recommended, selected or prioritized for display to a user based, in whole or in part, on (i) information persistently associated with the user or the user’s device, or (ii) the user’s previous interactions with media generated or shared by other users, including the user’s interactions on different online platforms, media or the pages, groups, or other user-generated media the user requests, subscribes to, otherwise selects, or a combination thereof.

Certain activities are excluded from the definition, including recommendations in response to a search inquiry, the display of specific media in response to express and unambiguous user requests, recommendations based on user-selected privacy and accessibility settings and the display of media that is a direct and private communication. The Rules do not apply to platforms with fewer than five million monthly active users or fewer than 20,000 monthly active users who are covered minors, except platforms with a primary user base of minors.

Age Assurance 

Rather than mandating a specific technology, the Rules establish a framework for evaluating whether age assurance methods are sufficiently accurate, reliable and privacy-protective. The Rules identify three categories of age assurance: (1) age estimation; (2) age inference; and (3) age verification.

“Age estimation” is defined as using analysis of a physical or behavioral feature to draw a conclusion regarding an individual’s age or age status. “Age inference” is defined as using verified information other than age to draw a conclusion regarding an individual’s age or age status. “Age verification” is defined as using generally accepted identification, including government-provided identification, or validation against an official records source, to confirm an individual’s age or age status.

Parental Consent 

The Rules establish a multi-step consent process. First, the covered platform operator must provide the minor with notice that the operator cannot legally provide the minor an addictive feed without verifiable parental consent, and obtain valid consent from the minor to request verifiable parental consent for an addictive feed. Second, if the minor provides such consent, a covered platform operator must provide the parent with notice that the operator cannot legally provide the minor an addictive feed without verifiable parental consent and offer the parent access to a method of verifiable parental consent.

The Rules also specify as follows:

• Covered platform operators are prohibited from disclosing to parents, in any notice provided to comply with the Rules, information revealing the minor’s activity on the platform, such as the minor’s search history or topics of interest.
• Parents and minors must have the option to withdraw consent at any time.
• If a parent refuses consent, the covered platform operator may renew a request for consent only at the request of the minor, and the mechanism for refusing consent must be at least as easy to use as the mechanism for granting consent.

Certification and Recordkeeping 

A covered platform operator must obtain a certification annually for each age assurance method it offers. The certification must include certain testing and must be documented in a written report, including testing protocols used and results. Covered platform operators must maintain copies of all test results, reports and certifications for no less than 10 years.

Enforcement 

Companies that fail to comply by the January 25, 2027, effective date face fines of up to $5,000 per violation, enforceable by the New York AG.