New York has finalized rules that will require major social media platforms to limit algorithmically personalized feeds and overnight notifications for users younger than 18 unless a parent gives consent.
The regulations released by Attorney General Letitia James establish how companies must determine users’ ages, obtain parental permission and protect the personal information collected during those processes. The Stop Addictive Feeds Exploitation for Kids Act, known as the SAFE for Kids Act, is scheduled to take effect Jan. 25, 2027.
The law is aimed at social media features designed to keep users continuously scrolling by selecting and organizing content based on data collected about their behavior. State officials contend those systems can contribute to excessive use among children and teenagers and are associated with depression, anxiety, eating disorders and disrupted sleep.
The rules do not prohibit minors from using social media, viewing content or communicating through covered platforms. Instead, they change which features may be offered by default and establish a process for families that choose to enable them.
What changes for users under 18
Under the law, users younger than 18 may not automatically be placed into an algorithmically personalized feed designed around their activity, interests and engagement history.
Without parental consent, minors must instead receive content from accounts they follow or otherwise select, presented in a fixed sequence such as chronological order. A platform may not deny a minor access to its broader service merely because the user or parent declines to authorize an addictive feed.
That means minors would still be able to search for content, follow accounts and access material available on the platform. The primary restriction applies to automated recommendation systems that continually serve content selected to maximize engagement.
The law also bars covered platforms from sending notifications to minors between midnight and 6 a.m. without parental consent. The restriction is intended to reduce late-night engagement and sleep disruption while leaving the underlying account and content accessible.
The state defines an addictive online platform as one that displays user-generated content and whose users spend at least 20% of their time on an addictive feed. That definition is intended to focus the law on services where algorithmic recommendations are a substantial part of the user experience.
How companies must verify age
Social media companies will have to determine that a user is an adult before allowing unrestricted access to algorithmic feeds or overnight notifications.
The final rules do not mandate a single age-verification system. Companies may use existing methods as long as those methods meet accuracy standards and include appropriate privacy protections.
Permitted approaches could include analyzing an uploaded image or video or verifying an email address or phone number and cross-checking it against other information that reflects the user’s age.
Platforms must provide at least one alternative to submitting a government-issued identification document. That requirement is intended to prevent users from being forced to disclose a driver’s license, passport or similar record simply to prove they are adults.
Companies must select age-assurance methods with high accuracy rates, test those systems annually and retain testing results for at least 10 years. Users identified as minors must also be given a way to update their status after turning 18.
The rules require platforms to collect only the minimum amount of information needed to determine age. Data used for age assurance or parental consent may not be repurposed and must be deleted or de-identified immediately after it serves its intended function.
Those privacy provisions are central to the state’s approach. Age verification has drawn concerns from civil liberties groups and online-safety advocates who warn that poorly designed systems could create new repositories of sensitive personal information.
What parental consent will require
A minor seeking access to a restricted feed or nighttime notifications must affirmatively request the feature and agree to have a parent notified.
The parent must then complete an age-assurance process before granting permission. Platforms may not treat silence, inactivity or continued use as consent.
Parents do not have to be shown the minor’s search history or topics of interest as part of the approval process. The rules are designed to verify that an adult is providing consent without automatically giving that adult access to the child’s browsing activity.
Both the parent and minor must be allowed to withdraw consent at any time. If permission is withdrawn, the platform would have to return the account to the protections required for minors.
A platform also may not block a young user from ordinary access to the service because consent was denied. The state’s framework is intended to make the restricted features optional rather than making them a condition of maintaining an account.
Enforcement begins in January
The SAFE for Kids Act was signed into law in June 2024 and authorized the Attorney General’s Office to establish the standards companies must follow before enforcement begins.
The final rules are scheduled for publication in the State Register on July 29, beginning a 180-day period before the law takes effect Jan. 25.
Companies that violate the law could face enforcement action from the Attorney General’s Office, including court orders directing them to stop prohibited practices. The law authorizes civil penalties of up to $5,000 for each violation, along with other potential remedies.
Gov. Kathy Hochul and James have framed the law as a response to what they describe as a youth mental health crisis intensified by online platforms designed to maximize engagement. The measure was sponsored by state Sen. Andrew Gounardes and Assemblymember Nily Rozic.
The regulations arrive as states across the country pursue different approaches to children’s online safety, including parental consent requirements, limits on data collection and restrictions on certain platform features. New York’s model focuses specifically on recommendation feeds and overnight notifications rather than imposing a broad ban on minors’ social media use.
The practical effect will depend heavily on how platforms design their age-assurance systems, which services qualify under the 20% threshold and how aggressively the state enforces the law after it takes effect.
For New York families, the most visible changes are expected to be simpler: minors should see less automatically recommended content by default, fewer notifications during overnight hours and a formal consent process before those features can be restored.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.