Protecting Children Online
Stop Addictive Feeds Exploitation (SAFE) for Kids Act
The New York Legislature passed the Stop Addictive Feeds Exploitation (SAFE) for Kids Act because New York minors are in the midst of a mental health crisis caused by harmful social media use. The Legislature found that social media platforms use feeds personalized by algorithms. These feeds can track tens or hundreds of thousands of data points about users to create a stream of media that can keep minors scrolling for dangerously long periods of time. Consistent with robust research from child mental health experts, the Legislature found that these hours spent on social media have caused harm to New York minors including depression, anxiety, suicidal ideation, and self-harm. The SAFE for Kids Act requires covered online platforms to take steps to limit excessive use of their platforms by children under the age of 18.
The SAFE for Kids Act specifically prohibits these online platforms from doing either of the following, unless the platforms confirm the user is an adult or, if the user is under 18, confirm the young person wants either of these features and get their guardian’s consent:
- providing addictive feeds that personalize media
- sending notifications, between the hours of midnight and 6 a.m. (Eastern), related to addictive feeds
The law includes other conditions to ensure that New Yorkers can enjoy the benefits of the Act, without eliminating their access or endangering their privacy.
The law goes into effect on January 25, 2027. The OAG has published final regulations, 13 N.Y.C.R.R. sections 700.1-700.11, which outline how platforms covered by the law must implement the law’s requirements. The regulations include a roadmap for how such platforms can determine whether a user is under or over the age of 18. They also set up meaningful parameters for platforms that decide to set up a consent process for the prohibited features.
The SAFE for Kids Act required OAG to issue regulations—also referred to as rules—regarding how a platform covered by the law can determine whether a user is a minor and their guardian’s consent. The OAG has completed the rulemaking process required by law, which includes inviting, receiving, and reviewing feedback from the public.
The following are the historical documents OAG published as part of this rulemaking process:
Advanced notice of proposed rulemaking (ANPRM)
The ANPRM was an invitation to the public to respond to posed questions and to provide requested information. The ANPRM was published on August 1, 2024. The comment period closed on September 30, 2024.
View SAFE for Kids ANPRM
Notice of proposed rulemaking (NPRM)
As required by the State Administrative Procedure Act (SAPA), the NPRM gave the public an opportunity to review and submit comments on the proposed rules, OAG’s statements of regulatory impact, and other required analyses. The NPRM was released publicly on September 15, 2025. The comment period closed on December 1, 2025.
View the SAFE for Kids NPRM
Adoption of final rules
As required by the State Administrative Procedure Act (SAPA), OAG has adopted final regulations and published an assessment of public comments and other required analyses.
Child Data Protection Act
Advanced Notice of Proposed Rulemaking pursuant to New York General Business Law section 899-ee et seq.
The New York State Office of the Attorney General (OAG) is issuing this Advanced Notice of Proposed Rulemaking (ANPRM) to solicit comments, data, and other information to assist the office in crafting rules to protect children's privacy pursuant to New York General Business Law section 899-ee et seq. (GBL section 899-ee).[2]
In recognition of the unique privacy needs of children, the New York legislature passed the Child Data Protection Act (CDPA) to ensure the privacy and safety of the personal data of New Yorkers under the age of 18. The CDPA primarily applies to operators of a “website, online service, online application, mobile application, or connected device, or portion thereof” who “alone or jointly with others, controls the purposes and means of processing... data that identifies or could reasonably be linked, directly or indirectly, with a specific natural person or device” where both of the following are true (GBL section 899-ee(1)-(4)):
- The operator actually knows that the data is from a minor user.
- The data is collected from a website, online service, online application, mobile application, or connected device, or portion thereof that is “primarily directed to minors.”
If a user’s device “communicates or signals that the user is or shall be treated as a minor,” the operator must “treat that user” as a minor (GBL section 899-ii(1)).
The CDPA requires such operators to process, and permits most third parties to process, the personal information of known minors, or data from services primarily directed to minors, only where they are permitted under the federal Children’s Online Privacy Protection Act and its enacting regulations (U.S.C. section 6502) for children under the age of 13, or for children between 13 and 17, where it is either “strictly necessary” for a number of specified purposes, or the operator has obtained “informed consent” (GBL section 899-ff(1)).
Those specified purposes include (GBL section 899-ff(2)):
- “providing or maintaining a specific product or service requested by the [user]”
- “conducting the operator's internal business operations...”
- “identifying and repairing technical errors that impair existing or intended functionality”
- “protecting against malicious, fraudulent, or illegal activity”
- “investigating, establishing, exercising, preparing for, or defending legal claims”
- “complying with federal, state, or local laws, rules, or regulations”
- “complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities”
- “detecting, responding to, or preventing security incidents or threats”
- “protecting the vital interests of a natural person”
Requests for “informed consent” must be made pursuant to a number of requirements to ensure that users are able to effectively assess the purpose of the processing and understand their rights (GBL section 899-ff(3)(a)). Consent must be freely revocable, and requests for consent may not be made more than once a year (GBLsection 899-ff(3)(b)-(c)). In addition, if a user’s device “communicates or signals” that the user does not consent to processing, the operator must adhere to that communication or signal (GBL section 899-ff(3)(d), (ii)(2)). Operators may not “withhold, degrade, lower the quality, or increase the price” of their services because of an inability to obtain consent (GBL section 899-ff(4)).
Operators may not purchase or sell, or allow another to purchase or sell, the personal data of minors (GBL section 899-ff(5)).
Where an operator relies upon a “processor” to process the data of minors on their behalf, they must enter into a “written, binding agreement” requiring the processor to process minor data only pursuant to the directives of the operator or as required by law, and to otherwise assist the operator in ensuring compliance with the CDPA (GBL section 899-gg).
When a minor user turns 18 or older, the privacy protections of the CDPA continue to apply to any data gathered while the user was a minor unless the operator receives informed consent for additional processing (GBL section 899-hh).
Third-party operators — such as the operator of a pixel or API that gathers data from a website run by another operator — are treated as operators under the CDPA and may process the personal information of minors only with informed consent from the user (if 13 or older) or the user’s parent (if under 13), with three exceptions (GBL section 899-jj):
- where the data is strictly necessary for a purpose specified in GBL section 899-ff(2)
- where the third-party operator “received reasonable written representations from the operator through whom they are collecting the data that the user provided informed consent for such processing”
- where they lack both “actual knowledge that the [user] is a minor; and” do not know that they are collecting data from a website, online service, online application, mobile application, or connected device, or portion thereof, [that] is primarily directed to minors
Questions for Public Comment
The OAG is issuing this ANPRM to solicit comments, including personal experiences, research, technology standards, and industry information that will assist OAG in determining what rulemaking will be most important to effectuate the purposes of the CDPA. The OAG seeks the broadest participation in the rulemaking and encourages all interested parties to submit written comments. In particular, OAG seeks comment from interested parties — including New York parents and children, consumer advocacy groups, privacy advocacy groups, industry participants, and other members of the public — on the following questions. Please provide, where appropriate, examples, data, and analysis to back up your comments.
The ANPRM comment period is now closed.
- The Child Data Protection Act applies where either operators have actual knowledge that a given user is a minor, or the operators’ websites or online services are “primarily directed to minors” (GBL section 899-ee(1)). What factors should OAG regulations assess when determining if a website or online service is primarily directed to minors?
- At present, the federal Children’s Online Privacy Protection Act’s enacting regulations assess whether a website or online service is “directed to children” under 13 based on the following non-exclusive factors: “subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the Web site or online service, as well as whether advertising promoting or appearing on the Web site or online service is directed to children... [and] consider competent and reliable empirical evidence regarding audience composition, and evidence regarding the intended audience” (16 CFR section 312.2). Should OAG’s assess a different set of factors when assessing what is attractive to minors under the age of 13? Why or why not?
- The interests of older teens are likely to be largely identical to the interests of many adults, so websites and online services directed at adults will generally also be of significant interest to many older teens. How should OAG regulations ensure that websites and online services that are directed to adults are not deemed “primarily directed to minors” based on these overlapping interests?
- What factors would be relevant in assessing whether websites or online services are primarily directed to minors or older teens?
- What factors would be relevant in assessing whether websites or online services are primarily directed to minors or younger teens?
- Should OAG regulations include separate tests for different age groups, or a single test with factors stretching across age groups? If the regulations should treat age groups differently, how and why?
- Are there factors that are more relevant than others in assessing whether a website or online service is primarily directed to minors? Which ones? Why? Is there research or data that shows the importance of these factors? How should OAG regulations emphasize these factors?
- Should OAG regulations treat websites or online services differently where they become primarily directed to minors based on changes outside of their control — such as minors becoming attracted to new kinds of content, or a large number of minors independently finding the service — compared to those that were always primarily directed to minors or that sought out minors for their audience?
- What does the current research on marketing, development psychology, or other fields say or suggest about what kinds of content or experiences minors are particularly attracted to? What does the current research say or suggest about what kinds of content or experiences are designed primarily for minors? How does the research differentiate between minors of different ages or age groups? How should this research be incorporated into OAG regulations?
- What other laws, regulations, or industry standards exist that contemplate whether material may be targeted towards minors? Do they impose restrictions on targeting towards minors of any age, or do they apply only to certain ages or age groups? On what are they based? How effective have they been at capturing the empirical behavior of minors?
- The Child Data Protection Act’s obligations include website or online services, “or portions thereof,” that are primarily directed to minors. Should OAG regulations distinguish portions created by an operator and portions created by users of the website or online service? If so, how?
- How should OAG regulations concerning the definition of personal data account for anonymized or deidentified data that could potentially still be re-linked to a specific individual (GBL section 899-ee(4))?
- The CDPA’s definition of “sell” includes sharing personal data for “monetary or other valuable consideration” (GBL section 899-ee(7)). Are there examples of ways operators may share personal data that do not constitute a sale that should be explicitly noted in OAG regulations?
- What factors should OAG consider in defining what processing is “strictly necessary” to be permissible without requiring specific consent? N.Y. GBL sections 899-ff(1)(b), 899-ff(2).
- The CDPA permits operators to process personal data without needing to obtain consent when “providing or maintaining a specific product or service requested by the covered user.” GBL section 899-ff(2)(a). Many modern online services bundle products or services together, or include ancillary products or services in response to a user request: for example, a cooking app might automatically display nearby groceries with relevant ingredients when a user looks up a recipe, which would require processing the user’s geolocation information. What factors should OAG consider in determining whether bundled products or services are incorporated into the “product or service requested by the covered user”?
- The CDPA permits processing for “internal business operations.” Are there examples of permissible processing pursuant to internal business operations that should be explicitly noted in OAG’s regulations? GBL section 899-ff(2)(b).
- The CDPA permits teenagers (minors between the ages of 13 and 17) to provide informed consent to processing on their own behalf (GBL section 899-ff(3)). What obligations should OAG regulations specify concerning the manner in which operators may request such informed consent?
- How can OAG ensure that teenagers are provided with notices that will effectively convey the potential risks, costs, or benefits of requested processing?
- How should OAG regulations concerning requests for informed consent balance between providing users with necessary and relevant information, but not overwhelming users with too much information or too many choices?
- How should OAG regulations treat requests for informed consent to multiple different kinds of processing at the same time or in short succession?
- What methods should OAG regulations specify may or must be made available to withdraw informed consent when it is provided?
- How can OAG regulations ensure that requests for informed consent, and any accompanying disclosures, are understandable and effective for New York teenagers from all communities?
- What standards should OAG regulations set for acceptable device communications or signals that a user is a minor or consents or refuses to consent to data processing? GBL sections 899-ff, 899-ii.
- Are there other factors or considerations related to obtaining informed consent that OAG regulations should consider?
- What methods do websites, online services, online applications, mobile applications, or connected devices presently use to determine whether an individual is the parent or legal guardian of a given user? What costs — to either the parent or the website, online service, online application, mobile application, or connected device — are associated with these methods? What information do they rely on?
- Where a device communicates that a user is under the age of 13 pursuant to GBL section 899-ii(1), how can OAG regulations ensure that any communications consenting to processing under GBL section 899-ii(2) satisfy the parental consent requirements of 15 U.S.C. section 6502 and its implementing regulations?
- What are the most effective and secure methods that currently exist for any form of obtaining parental consent?
- Are there other factors or considerations related to obtaining parental consent that OAG regulations should consider?
[1] The SAFE for Kids Act also provides OAG with authority to “promulgate such rules and regulations as are necessary to effectuate and enforce” the Act. GBL section 1505.
[2] The statute authorizes OAG to “promulgate such rules and regulations as are necessary to effectuate and enforce the provisions of this article.” GBL section 899-kk.
Understand web tracking to keep your family safe
Websites and apps often use cookies and other technologies to generate customized ads and otherwise track your and your kids’ activity. We created this guide to help you understand how companies may monitor you, so you can better safeguard your privacy.
A consumer guide to web tracking
Protect your privacy by managing how businesses monitor you online.