Overview of New York’s SAFE for Kids Act and Its Regulatory Framework
New York’s Stop Addictive Feeds Exploitation (SAFE) for Kids Act establishes legal restrictions on algorithmic feeds targeting minors, effective January 25, 2027. The law is enforced under final rules published by the New York Attorney General in July 2026, which define key terms, compliance requirements, and penalties for violations. The legislation aims to mitigate the risks of addictive design in online platforms by mandating age assurance verification and limiting algorithmic recommendations for minors.
The act applies to operators of online platforms that provide addictive feeds—a term defined as systems that recommend, prioritize, or select media based on persistent user or device data, or cross-platform interaction histories. These feeds must not exceed 20% of total user engagement on a platform over any six-month period to avoid classification as a significant service component. Exemptions exist for platforms with fewer than 5 million monthly active users or fewer than 20,000 covered minors, except those primarily targeting minors.
Penalties for non-compliance include fines of $5,000 per violation, enforceable by the New York Attorney General. Compliance hinges on certified age assurance methods and the elimination of addictive feed features for users under 18.
Definitions and Key Terms Under the Final Rules
The final rules introduce precise definitions to clarify scope and obligations. An addictive feed is explicitly defined as a platform feature that recommends or prioritizes media based on persistent user or device data, or cross-platform interactions. Exclusions apply to recommendations driven by privacy settings, direct user requests, or pre-existing content sequences (e.g., playlists or chronological feeds). Platforms must demonstrate that such feeds do not constitute a significant portion of their service—measured as 20% or more of user time over a six-month period—to avoid regulatory triggers.
The rules require accredited third-party validation, with accreditation granted by bodies like the American National Standards Institute (ANSI) or equivalent organizations. Certified methods must achieve false positive rates no higher than 0.1% for ages 0–7, 1% for ages 8–13, 2% for ages 14–15, 8% for age 16, and 15% for age 17.
Certification aligns with international standards, including ISO/IEC 27566-1:2025 and IEEE 2089.1, both of which outline frameworks for age verification, estimation, and inference. Age verification relies on government-issued identification or official records, while age estimation uses behavioral or physical features. Age inference derives age conclusions from non-age data, such as purchase history or device usage patterns. Inconclusive outcomes—where age cannot be determined despite full data submission—are excluded from false positive calculations.
Operators must also define covered operators, covered minors, and covered users to determine applicability. Covered operators include platform providers, their affiliates, and agents involved in compliance. Covered minors are users confirmed to be under 18, while covered users are New York residents not acting as operators or affiliates. Exempt platforms are those with fewer than 5 million monthly active users or fewer than 20,000 covered minors, though platforms primarily serving minors are never exempt.
Compliance Requirements and Technical Standards
Compliance with the SAFE for Kids Act requires operators to implement certified age assurance methods and eliminate addictive feeds for minors. The rules mandate that platforms with addictive feeds must verify user age before exposing them to such content. Failure to do so constitutes a violation, subject to fines of $5,000 per instance.
Operators must delete user data in a manner that prevents re-identification, including de-identifying information linked to individuals or devices. De-identified data cannot be reprocessed or re-linked, and operators must publicly commit to these restrictions. The rules also prohibit the use of de-identified data for purposes beyond those permitted by the act, ensuring minimal retention periods.
Platforms must measure addictive feed engagement over six-month periods to assess compliance. If addictive feeds account for 20% or more of user time, the platform is classified as an addictive online platform, triggering full regulatory obligations. Exempt platforms avoid these requirements but remain subject to age verification for minors.
Operators are responsible for designing systems resilient to such attempts, including multi-factor verification or behavioral analysis. Inconclusive outcomes, where age cannot be determined despite full cooperation, do not count toward false positive rates but must be addressed through alternative verification steps.
Required actions
- Do not show algorithmically personalised feeds or send overnight notifications to users under 18 without verifiable parental consent - Determine age through commercially reasonable, certified age-assurance methods and protect the data collected