SAFE for Kids Act Implementing Rules

Part 700 of Title 13 of the NYCRR

> Part 700 SAFE for Kids Act
> Part 700.1 Definitions
> Part 700.2 Prohibition of Addictive Feeds
> Part 700.3 Prohibition of Nighttime Notifications
> Part 700.4 Actual Knowledge of Minor Age Status and Age Assurance Methods
> Part 700.5 Certification of Age Assurance Methods
> Part 700.6 Appeals Process
> Part 700.7 Data Use and Protection
> Part 700.8 Remedies
> Part 700.9 Miscellaneous
> Part 700.10 Severability
> Part 700.11 Effective Date

Download a printable version of the rules

Part 700. SAFE for Kids Act

Proposed Action: Add Part 700 of Title 13 NYCRR

Statutory Authority: General Business Law, Article 45, 1500-1508

Subject: SAFE for Kids Act

Purpose: Implement the SAFE for Kids Act as directed by Article 45 of General Business Law, specifically and as necessary to eﬀectuate and enforce Article 45.

Part 700.1 Definitions

For purposes of this Part:

(a) Accredited Third-Party. The term Accredited Third-Party means a person recognized by the American National Standards Institute (ANSI) or equivalent accreditation body, in accordance with a recognized industry standard, as qualified to certify an age assurance method.

(b) Accuracy Minimum. The term Accuracy Minimum means:

(1) a rate of false positives for an age assurance method that is equal to or less than the following: 0.1% of minors ages 0 to 7; 1% of minors ages 8 to 13; 2% of minors ages 14 to 15; 8% of minors age 16; 15% of minors age 17, excluding failures or refusals by a user to provide requested data and inconclusive age assurance outcomes; and

(2) a rate of detecting method circumvention for an age assurance method that meets or exceeds 98%.

(c) Addictive Feed. The term Addictive Feed means an online platform, or a portion thereof, in which multiple pieces of media from an online platform are:

(1) shared or generated by users, and

(2) concurrently or sequentially, recommended, selected, or prioritized for display to a user based, in whole or in part, on

(i) information persistently associated with the user or the user’s device; or

(ii) the user’s previous interactions with media generated or shared by other users including the user’s interactions on diﬀerent online platforms, media or the pages, groups, or other user-generated media the user requests, subscribes to, otherwise selects, or a combination thereof.

(3) The following conduct does not constitute an addictive feed:

(i) the recommendation, prioritization, or selection of media based on user-selected privacy or accessibility settings, or technical information concerning the user’s device;

(ii) the display of specific media in response to express and unambiguous user requests or media by an author, creator, or poster of media the user subscribes to;

(iii) the display of media users share to a page or group the user subscribes to;

(iv) the display of media where the user expressly and unambiguously requests

(a) the specific media;

(b) the media of a specified author, creator, or poster of media;

(c) the media users to a page or group share; or

(d) that specific media or the media of a specified author, creator, or poster of media be blocked, prioritized or deprioritized for display;

(v) the display of media that is a direct and private communication;

(vi) the recommendation, prioritization, or selection of media only in response to a specific search inquiry by the user;

(vii) the recommendation, prioritization, or selection of media for display where the media is exclusively next in a pre-existing sequence from the same author, creator, poster, or source; or

(viii) the recommendation, prioritization, or selection of media that is necessary to comply with the provisions of this Part and any regulations promulgated pursuant to this Part.

(d) Addictive Online Platform. The term Addictive Online Platform means an online platform that oﬀers or provides users one or more addictive feeds as a significant part of the services provided by such online platform. An addictive feed or multiple addictive feeds jointly are a significant part of the services provided by an online platform if 20 percent or more of time spent by monthly active users on an online platform is spent on addictive feeds measured over any one six-month period an online platform chooses to measure in the prior calendar year.

(e) Adult. The term Adult means an individual 18 years of age or older.

(f) Aﬃliate. The term Aﬃliate is any person that directly, or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with the person specified.

(g) Age Status. The term Age Status means the state of being a minor or an adult.

(h) Age Assurance Method. The term Age Assurance Method means any type of age estimation, age inference, or age verification.

(i) Age Estimation. The term Age Estimation means to use analysis of a physical or behavioral feature to draw a conclusion regarding an individual’s age or age status.

(j) Age Inference. The term Age Inference means to use verified information other than age to draw a conclusion regarding an individual’s age or age status.

(k) Age Verification. The term Age Verification means to use generally accepted identification, including government-provided identification, or validation against an oﬃcial records source, to confirm an individual’s age or age status.

(l) Certification. The term Certification means the confirmation by an accredited third-party that an age assurance method meets:

(1) International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 27566-1:2025 Information security, cybersecurity and privacy protection — Age assurance systems, Part 1: Framework, published December 2025, publisher address: ISO/IEC, P 401, Ch. de Blandonnet 8, CH-1214 Vernier, Geneva, or Institute for Electrical and Electronics Engineers (IEEE) 2089.1, 2024 Standard for Online Age Verification, published March 21, 2024, publisher address: IEEE, 3 Park Avenue, New York, NY 10016-5997, both available for viewing at Department of State, One Commerce Plaza 99 Washington Avenue, Suite 650 Albany, NY 12231-0001, or an equivalent industry standard;

(2) the accuracy minimum; and

(3) the testing requirements in section 700.5(b) of this Part. "Certify" means the act of certification and "certified" means having having received certification.

(m) Covered Minor. The term Covered Minor means a user of an online platform in the State of New York for whom the covered operator has actual knowledge the user is a minor.

(n) Covered Operator. The term Covered Operator means any person who operates or provides an addictive online platform and the person’s agents and aﬃliates involved in operating or providing an addictive online platform or complying with this Part.

(o) Covered User. The term Covered User means a user of an online platform in the State of New York, not acting as an operator, or agent or aﬃliate of the operator of such online platform or any portion thereof.

(p) Delete. The term Delete means to permanently destroy, remove, or de-identify information using reasonable measures to protect against the unauthorized access or use of such information and to ensure that such information may not be retrieved after the deletion process has been completed. For purposes of this section, to de-identify information, a covered operator must:

(1) take reasonable measures to de-identify any information that identifies or can reasonably be linked to an individual or device;

(2) take reasonable measures to ensure the de-identified information cannot be re-linked with an individual or device;

(3) not process and must publicly commit not to process the de-identified information except only in its de-identified state, and must not attempt and must publicly commit not to attempt to re-identify or re-link the de-identified information;

(4) take reasonable measures to ensure any recipients of de-identified information also abide by these restrictions; and

(5) take reasonable measures to ensure that the de-identified information is held for the minimum time necessary to fulfill the purposes permitted under this Part and is not used for any other purpose.

(q) Exempt Online Platform. The term Exempt Online Platform means an online platform that meets the definition of addictive online platform and has fewer than 5 million monthly active users or fewer than 20,000 monthly active users who are covered minors, except addictive online platforms whose primary user base is minors are not exempt online platforms.

(r) False Negative. The term False Negative means incorrectly identifying an adult as a minor.

(s) False Positive. The term False Positive means incorrectly identifying a minor as an adult.

(t) Inconclusive Age Assurance Outcome. The term Inconclusive Age Assurance Outcome means following receipt of all requested information from a user, and absent detection of method circumvention, a determination that the age assurance method cannot provide an age or age status for that user.

(u) Information Persistently Associated. The term Information Persistently Associated means any information that a covered operator associates with a user or a user’s device over time. Information is not persistently associated if the covered operator does not use the information to recognize the user or the user’s device over time.

(v) Media. The term Media means text, an image, or a video.

(w) Method Circumvention. The term Method Circumvention means submission of false data or interference with an age assurance method.

(x) Minor. The term Minor means an individual under 18 years of age.

(y) Monthly Active User. The term Monthly Active User means an individual who, in the previous calendar month or the one-month average measured across the previous quarter, accesses an online platform in a manner that includes access to an addictive feed and remains on the online platform for at least one minute.

(z) Nighttime Notifications. The term Nighttime Notifications means notifications concerning an addictive feed between the hours of 12 AM Eastern and 6 AM Eastern. Notifications required by applicable federal, state, or local laws are not nighttime notifications.

(aa) Online Platform. The term Online Platform means a website, online service, online application, or mobile application.

(bb) Operator. The term Operator means any person that operates or provides an online platform.

(cc) Parent. The term Parent means an individual who is recognized under State law as:

(1) acting in parental relation to the covered minor;

(2) having the status of a legal guardian or custodian for the covered minor; or

(3) in the case of an individual who otherwise would qualify as a minor, having the status of a parent to the covered minor.

(dd) Person. The term Person means an individual, partnership, corporation, association, or any other form of business enterprise.

(ee) Self-Declaration. The term Self-Declaration means an action by a covered user, such as a representation in writing or clicking on a confirmation button, indicating the covered user’s age or age status.

(ff) Technical Information Concerning a User’s Device. The term Technical Information Concerning a User’s Device means information that is associated with the user’s device and technical in nature. Technical information concerning a user’s device:

(1) is not information linked to the user’s identity;

(2) cannot include information linked, directly or indirectly, to the user’s previous interactions with media generated or shared by other users; and

(3) is not otherwise processed for the purpose of providing an addictive feed or nighttime notifications.

(gg) Total Accuracy Minimum. The term Total Accuracy Minimum means:

(1) a combined rate of false positives and inconclusive age assurance outcomes for an age assurance method that is equal to or less than the following: 0.1% of minors ages 0 to 7; 1% of minors ages 8 to 13; 2% of minors ages 14 to 15; 8% of minors age 16; 15% of minors age 17, excluding failures or refusals by a user to provide requested data; and

(2) a rate of detecting method circumvention that meets or exceeds 98%.

(hh) User. The term User means a person that uses a covered operator’s online platform or any portion thereof and is not acting as the covered operator or an agent or aﬃliate of the covered operator.

(ii) Valid Consent. The term Valid Consent means consent that is clear and unambiguous, specific, informed, and freely granted.

(1) “Clear and unambiguous” means an expression of consent through an individual’s aﬃrmative action.

(2) “Specific” means the request for consent is presented separately from any other request by the covered operator. A covered operator may request consent for an addictive feed and for nighttime notifications in a single transaction, provided that an individual may grant or refuse consent separately for each feature.

(3) For purposes of sections 700.2 and 700.3 of this Part, “informed” means a notice pursuant to those sections that is provided in plain language and is understandable and accessible to the target audience. Any such notice must be made available in at least the twelve most commonly spoken languages in the State of New York consistent with section 202-a of the Executive Law, and may be provided in written or any other form that otherwise complies with this Part.

(4) “Freely granted” means that the mechanism for refusing consent is at least as easy to use as the mechanism for granting consent and any previously granted consent may be easily modified or withdrawn at any time.

(jj) Zero-Knowledge Proof Age Assurance. The term Zero-Knowledge Proof Age Assurance means a cryptographic technique that allows an individual to demonstrate age status using verified data without revealing additional information to the operator or any third-party beyond the validity of the individual’s age status.

Part 700.2 Prohibition of Addictive Feeds

(a) It shall be unlawful for a covered operator to provide an addictive feed to a covered user unless:

(1) the covered operator completes an age assurance method consistent with section 700.4 of this Part to determine the covered user is not a covered minor and the covered operator does not otherwise have actual knowledge of the covered user’s minor age status; or

(2) the covered user is a covered minor and the covered operator has obtained verifiable parental consent consistent with subdivision (e) of this section to provide an addictive feed to the covered minor.

(b) A covered operator is not required to provide a covered minor access to a method of verifiable parental consent for addictive feeds.

(c) Exempt online platforms are exempt from the requirements of this Part. If an addictive online platform no longer qualifies as an exempt online platform, it has 180 days from the first such instance and 30 days from any subsequent instances before it must comply with subdivision (a) of this section.

(d) In determining whether a user is a covered user, a covered operator must

(1) take into account all reliable information accessible by the covered operator regarding the user’s location including technical information concerning a user’s device and covered user data the covered operator possesses or accesses for marketing, content selection, or other commercial purposes; and

(2) take reasonable steps to investigate and detect covered user eﬀorts to conceal or misrepresent their location and, in such instances, employ reasonable methods utilizing available data to determine whether the user is a covered user.

(e) Verifiable parental consent requirements for addictive feeds.

(1) Consent requirements

(i) Consent from a covered minor. To request verifiable parental consent under paragraph (2) of subdivision (a) of this section, a covered operator must:

(a) provide the covered minor notice that the covered operator cannot legally provide the covered minor an addictive feed without verifiable parental consent; and

(b) obtain valid consent from the covered minor to request verifiable parental consent for an addictive feed.

(ii) Consent from the parent. If a covered minor provides valid consent consistent with subparagraph (i) of this paragraph, a covered operator must:

(a) provide the parent with notice that the covered operator cannot legally provide the covered minor an addictive feed without verifiable parental consent; and

(b) oﬀer the parent access to a method of verifiable parental consent that meets the requirements of this section.

(2) Withdrawal of consent. A covered operator must provide covered minors and parents a simple, accessible mechanism to withdraw consent for an addictive feed at any time. The mechanism to withdraw consent must be at least as easy to use as the mechanism used to give consent. In no event shall a covered minor or parent be required to interact with a live representative to withdraw consent if they did not do so to give consent.

(3) Renewed request for consent. If a parent refuses valid consent for an addictive feed, a covered operator may renew a request for consent from a parent only at the request of the covered minor.

(4) Notice requirements. The notice required by subparagraphs (1)(i) and (ii) of paragraph (1) of this subdivision must be clear and conspicuous, and provided at or before any request for consent. The notice must:

(i) identify the addictive online platform;

(ii) identify the covered minor’s account, or profile, or username, as applicable;

(iii) provide the following information with equal prominence and in plain language that is understandable and accessible to the target audience:

(a) the law of the State of New York does not allow the covered operator to provide media to a minor using a feature in which the operator recommends, selects, or prioritizes media based on information associated with that minor without parental consent except in limited circumstances.

(b) the minor can access the platform with a feed that does not include this feature including while any request for consent under this section is pending; and

(c) a covered minor or parent can modify or withdraw their consent

(5) Methods of verifiable parental consent. Any verifiable parental consent method must:

(i) determine the parent’s age status pursuant to section 700.4 of this Part, making available any instructions to the parent in at least the 12 most commonly spoken languages in the State of New York consistent with section 202-a of the Executive Law, in written or any other form that otherwise complies with these regulations;

(ii) give the parent the option to provide valid consent;

(iii) be reasonably calculated, in light of available technology, to ensure that the individual providing consent is a parent of the covered minor;

(iv) make reasonable eﬀorts to protect the covered users’ and parents’ privacy and safety;

(v) be reasonably calculated, in light of available technology, to account for the likelihood of circumvention, fraud, or misuse of the method;

(vi) include at least one option that does not require the parent to furnish government-provided identification unless the covered operator collects or possesses a parent’s government-provided identification to comply with other laws and obtains consent to use the same for verifiable parental consent; and

(vii) include at least one option that does not require the parent to create an account with the covered operator or require the parent to purchase additional goods or services from the covered operator.

(6) Notwithstanding the requirements of this subdivision, if an addictive online platform is a “website or online service directed to children,” under 15 U.S.C. § 6501(10) and its implementing regulation 16 C.F.R. § 312.2, or if a user is a covered minor under 13, a covered operator may use the methods for verifiable parental consent listed under 16 C.F.R. § 312.5, provided:

(i) the covered operator provides the parent with notice as required by paragraph (4) of this subdivision (e);

(ii) the covered operator complies with paragraph (7) of this subdivision; and

(iii) the method is reasonably calculated, in light of available technology, to account for the reasonable likelihood of circumvention, fraud, or misuse of the method.

(7) A covered operator must review and update any verifiable parental consent method at least annually to ensure continued compliance with this section.

Part 700.3 Prohibition of Nighttime Notifications

(a) It shall be unlawful for a covered operator to provide nighttime notifications to a covered user unless:

(1) the covered operator uses an age assurance method consistent with section 700.4 of this Part to determine the covered user is not a covered minor and the covered operator does not otherwise have actual knowledge of the covered user’s minor age status; or

(2) the covered user is a covered minor and the covered operator has obtained verifiable parental consent consistent with subdivision (e) of this section to provide nighttime notifications to the covered minor.

(b) A covered operator is not required to provide a covered minor access to a method of verifiable parental consent for nighttime notifications.

(c) Exempt online platforms are exempt from the requirements of this Part. If an addictive online platform ceases to be an exempt online platform, it has 180 days from the first such instance and 30 days from any subsequent instances before it must comply with subdivision (a) of this section.

(d) In determining whether a user is a covered user, a covered operator must

(e) Verifiable parental consent for nighttime notifications.

(1) Consent requirements.

(i) Consent from a covered minor. To request verifiable parental consent under paragraph (2) of subdivision (a) of this section, a covered operator must:

(a) provide the covered minor notice that the covered operator cannot legally provide the covered minor nighttime notifications without verifiable parental consent; and

(b) obtain valid consent from the covered minor to request verifiable parental consent for nighttime notifications.

(ii) Consent from the parent. If a covered minor provides valid consent consistent with subparagraph(i) of this paragraph, a covered operator must:

(a) provide the parent with notice that the covered operator cannot legally provide the covered minor nighttime notifications without verifiable parental consent; and

(b) oﬀer the parent access to a method of verifiable parental consent that meets the requirements of this section.

(2) Withdrawal of consent. A covered operator must provide covered minors and parents a simple, accessible mechanism to withdraw consent for nighttime notifications at any time. The mechanism to withdraw consent must be at least as easy to use as the mechanism used to give consent. In no event shall a covered minor or parent be required to interact with a live representative to withdraw consent if they did not do so to give consent.

(3) Renewed request for consent. If a parent refuses valid consent for nighttime notifications, a covered operator may renew a request for consent from a parent only at the request of the covered minor.

(4) Notice requirements. The notice required by subparagraphs (i) and (ii) of paragraph (1) of this subdivision must be clear and conspicuous, and provided at or before any request for consent. The notice must:

(i) identify the addictive online platform;

(ii) identify the covered minor’s account, or profile, or username, as applicable;

(iii) provide the following information with equal prominence and in plain language that is understandable and accessible to the target audience:

(a) the law of the State of New York does not allow the covered operator to provide notifications between the hours of 12 AM Eastern and 6 AM Eastern to a covered minor concerning a feed that uses a feature in which the operator recommends, selects, or prioritizes media based on information associated with that minor without parental consent except in limited circumstances;

(b) the minor can access the platform without these nighttime notifications including while any request for consent under this section is pending; and

(c) a covered minor or parent can modify or withdraw their consent.

(5) Methods of verifiable parental consent. Any verifiable parental consent method must:

(i) determine the parent’s age status pursuant to section 700.4 of this Part, making available any instructions to the parent in at least the twelve most commonly spoken languages in the State of New York consistent with section 202-a of the Executive Law, in written or any other form that otherwise complies with these regulations;

(ii) give the parent the option to provide valid consent;

(iii) be reasonably calculated, in light of available technology, to ensure that the individual providing consent is a parent of the covered minor;

(iv) make reasonable eﬀorts to protect the covered users’ and parents’ privacy and safety;

(v) be reasonably calculated, in light of available technology, to account for the likelihood of circumvention, fraud, or misuse of the method;

(6) Notwithstanding the requirements of this subdivision (e), if an addictive online platform is a “website or online service directed to children,” under 15 U.S.C. § 6501(10) and its implementing regulation 16 C.F.R. § 312.2, or if a user is a covered minor under 13, a covered operator may use the methods for verifiable parental consent listed under 16 C.F.R. § 312.5, provided:

(i) the covered operator provides the parent with notice as required by paragraph (4) of this subdivision;

(ii) the covered operator complies with paragraph (7) of this subdivision; and

(iii) the method is reasonably calculated, in light of available technology, to account for the reasonable likelihood of circumvention, fraud, or misuse of the method.

(7) A covered operator must review and update any verifiable parental consent method at least annually to ensure continued compliance with this section.

Part 700.4 Actual Knowledge of Minor Age Status and Age Assurance Methods

(a) The following individually or jointly constitute actual knowledge of a covered user’s minor age status for purposes of this Part:

(1) Self-declaration of minor age status, provided that such self-declaration is requested by the covered operator or otherwise can reasonably be associated with the covered user;

(2) A covered operator’s use of one or more age assurance methods consistent with paragraph (1) of subdivision (b) of this section that results in a determination of minor age status;

(3) A covered operator’s possession or access to covered user data for marketing, content selection, or other commercial purposes that, if applied to an age assurance method the covered operator provides, would result in a determination of minor age status; or

(4) The covered operator’s good faith determination based on other, reliable evidence or knowledge that the covered user is a minor.

(b) To determine that a covered user is not a covered minor, covered operators must:

(1) Provide covered users one or more age assurance methods, each of which must be certified consistent with section 700.5 of this Part to meet the accuracy minimum and at least one of which must be certified consistent with section 700.5 of this Part to meet the total accuracy minimum; and either

(i) Receive a determination that the covered user has adult age status from at least one age assurance method provided to users pursuant to paragraph (1) of this subdivision (b); or

(ii) If all of the following are present, presume a covered user has adult age status:

(a) age assurance methods oﬀered by the covered operator pursuant to paragraph (1) of this subdivision (b) are completed for the covered user, including at least one age assurance method that meets the total accuracy minimum,

(b) each of the methods is inconclusive, and

(c) the covered operator otherwise has no actual knowledge that the covered user is a covered minor.

(c) If the covered operator provides age verification using government-provided identification as an age assurance method, the covered operator must:

(1) accept government-provided identification from all U.S. and non-U.S. jurisdictions;

(2) allow a user to proceed to the appeals process described in section 700.6 of this Part if all other age assurance methods oﬀered by the covered operator are inconclusive and the user declines to provide government-provided identification; and

(3) provide at least one age assurance method that does not require the furnishing of government-provided identification unless the covered operator necessarily collects or possesses such identification to comply with other laws or oﬀers the user a zero-knowledge proof age assurance method.

(d) With respect to investigations or changes in age status of covered users, a covered operator must:

(1) change a covered user’s adult age status to minor within 10 business days if the covered operator obtains actual knowledge that the covered user is a minor;

(2) conduct an investigation of any report or information indicating a covered user has minor age status or has falsified data related to adult age status, including through method circumvention, suﬃcient to determine whether the report or information constitutes reliable evidence of minor age status;

(3) conduct an investigation of new or previously undetected forms of method circumvention, including in response to public reports, direct reports to the operator or its agents, and monitoring of changes in aggregate age assurance outcomes consistent with undetected method circumvention, and if validated, take suﬃcient steps to correct resulting false positives and eﬀectively detect the form of method circumvention in the future; and

(4) provide covered minors a process to update their minor age status upon reaching adult status, at which time the covered user must undergo an age assurance method pursuant to subdivision (b) of this section.

(e) A covered operator must make available to covered users an explanation of any age assurance methods oﬀered and, in the event covered user data is requested, the purpose of the data request, how the data will be used, and when and how the data will be deleted.

(f) Covered operators may not introduce any design feature that discourages covered users from participating in or successfully completing an age assurance method or facilitates method circumvention by covered users.

(g) Covered operators must, initially and periodically thereafter, evaluate the accuracy, method circumvention, and user burden of their age assurance methods against alternative commercially reasonable age assurance methods that otherwise comply with the obligations in this Part. Covered operators must act reasonably and in good faith to adopt more eﬀective age assurance methods consistent with related industry and technological developments, including commercially reasonable age assurance methods with lower false positive and false negative outcomes and maximum method circumvention detection rates.

Part 700.5 Certification of Age Assurance Methods

(a) A covered operator must obtain a certification annually for each age assurance method it oﬀers.

(b) Certification of an age assurance method must include the following testing, which must be documented in a written report including testing protocols used and all results:

(1) false positive rate for ages 0-17; the data must be reported in aggregate and disaggregated by the age categories in the accuracy minimum;

(2) rate of inconclusive age assurance outcomes and the reason for each inconclusive age assurance outcome;

(3) false negative rate for ages 18-30; the data must be reported in aggregate and disaggregated by age categories 18, 19-20, 21-25, and 26-30;

(4) detection of method circumvention through testing consistent with a nationally or internationally recognized standard, or if none is available, including a variety of attack vectors weighted to reflect the most prevalent risks, with documentation of the quantity and type of attack methodologies tested;

(5) data collection, segregation, and deletion measures, in accordance with section 700.7 of this Part;

(6) data encryption and security measures; and

(7) determination of whether the age assurance method meets the accuracy minimum and total accuracy minimum.

(c) Test data used for certification of the accuracy minimum and the total accuracy minimum, and to fulfill the testing requirements in subdivision (b) of this section, must meet the following requirements:

(1) Sample size calculation must yield reliable results with a high confidence level and low margin of error using as a baseline the population of the State of New York most recently reported by the U.S. Census Bureau.

(2) Any images in a test dataset must reflect variation in photographic conditions, subject presentation, pose variation, and facial archetypes.

(3) The age assurance method being tested must not have been trained or tuned on the testing dataset or any substantially overlapping dataset.

(d) Covered operators must maintain copies of all test results, reports, and certifications generated in compliance with this section for no less than 10 years.

(e) To the extent an age assurance method has variable settings or options, a covered operator must only use settings or options for which the age assurance method received certification.

(f) In the event at least one ANSI-recognized or equivalent industry certification consistent with the requirements of this Part is not available for an age assurance method, covered operators may work with an accredited third-party to configure testing protocols consistent with subdivision (c) of this section and must retain records of the protocols and testing results.

Part 700.6 Appeals Process

(a) A covered operator shall implement a process for a user to appeal a covered operator’s classification of that user as a covered minor. The covered operator must:

(i) oﬀer one or more methods for a user to submit information and documentation in support of the user’s adult age status, including at least one option for documentation other than government-provided identification;

(2) evaluate the information and documentation submitted by the user;

(3) make a good faith determination as to whether the information and documentation provide a reasonable basis to reverse the covered operator’s previous conclusion regarding the covered user’s age status; and

(4) provide a written summary to the user of its decision, including an explanation of the basis for the decision.

(b) The process required by subdivision (a) of this section must be clear, conspicuous, and accessible.

(c) The covered operator must communicate the determination of the user’s appeal or request additional information from the user within 10 business days of receipt of the appeal. Where the covered operator requests additional information, the final determination of the appeal must be made and sent to the user expeditiously following receipt of the requested information.

(d) Notwithstanding the requirements in section 700.2 and section 700.4 of this Part, a covered operator may change a covered user’s age status from minor to adult based upon the covered operator’s determination of age status through the process required by this section.

Part 700.7 Data Use and Protection

(a) Data collected for the purpose of complying with any section of this Part:

(1) shall be the minimum necessary to comply with the applicable section of this Part;

(2) shall not be used for any purpose other than to comply with the applicable section of this Part;

(3) shall be collected and stored using industry-standard data security measures and as required by law, including encryption in transit and at rest; and

(4) shall be held for the minimum time necessary to comply with the applicable section of this Part and thereafter must be immediately deleted except as provided by subdivision (b) of this section.

(b) Covered operators must retain the following where applicable, for no less than 5 years:

(1) the fact that an age assurance method was attempted on a user;

(2) the age assurance method that successfully confirmed age status;

(3) the date on which an age assurance method resulting in determination of age status was conducted;

(4) the age status of the covered user;

(5) information collected to comply with this Part where necessary for compliance with any applicable provisions of State law or federal law or regulation; and

(6) for each age assurance method utilized, on a month-by-month basis:

(i) the total number of covered users who attempted to confirm age status using that method;

(ii) the total number of covered users for whom the covered operator successfully determined age status using that method;

(iii) the total number of covered users for whom the covered operator had successfully determined an adult age status using that method who the covered operator subsequently determined were covered minors; and

(iv) the total number of covered users denied adult status due to method circumvention.

(c) Covered operators may retain the estimated age of a covered user solely to determine age status for purposes of this Part with the covered user’s valid consent.

(d) Nothing in this section shall be construed to regulate data that is collected for a purpose that is unrelated to compliance with this Part.

(e) A covered operator must comply with all other applicable data protection and security laws. In case of conflict, the law that is more protective of a covered minor’s privacy and safety shall govern.

(f) Except as set forth in subdivision (b) of this section, nothing in this section shall be construed to require retention of data that identifies an individual user or to allow a covered operator to use data retained pursuant to this section, whether alone or together with other data, in order to identify an individual user.

Part 700.8 Remedies

The Attorney General may bring an action or special proceeding on behalf of the State of New York consistent with section 1508 of the General Business Law whenever it appears that any person has engaged in or is about to engage in any of the acts or practices in the State of New York stated to be unlawful in Article 45 of the General Business Law and the implementing regulations in this Part.

Part 700.9 Miscellaneous

(a) All requirements herein apply equally to covered operators that elect to engage or otherwise rely upon any third-party to comply with this Part.

(b) Other than as necessary to comply with section 700.2 and section 700.3 of this Part, a covered operator must not:

(1) withhold any product, service, or feature from a covered user or a parent;

(2) degrade or lower the quality of any product, service, or feature used by a covered user or a parent; or

(3) increase the price of any product, service, or feature used by a covered user or a parent.

(c) Except as expressly specified, nothing in this Part shall be construed as requiring a covered operator to give a parent any additional access to or special control over the data or accounts of a covered minor using an addictive online platform.

(d) Except as expressly and specifically required in this Part or as strictly necessary to comply with applicable laws, any notice provided by a covered operator in order to comply with this Part shall not disclose any information to the parent that reveals a covered user’s use of, or other activity associated with the addictive online platform. Specifically, but not exclusively, a covered operator’s notice shall not disclose:

(1) personalized attributes associated with the covered minor;

(2) content selections or interactions associated with the covered minor;

(3) specific pieces of content that may be accessible via the addictive feed, or that may be included in nighttime notifications;

(4) identities of other users of the addictive online platform; and

(5) settings choices made by the covered minor.

(e) Nothing in this Part shall be construed as preventing any action taken in good faith to restrict access to or availability of media that the covered operator considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.

Part 700.10 Severability

The provisions of this Part shall be severable, and if any item, subclause, clause, sentence, subparagraph, paragraph, subdivision, section, or subpart of this Part, or the applicability thereof to any person or circumstances, shall be adjudged by any court of competent jurisdiction to be invalid, such judgment shall not aﬀect, impair or invalidate the remainder thereof, nor the application thereof, but shall be confined in its operation to the item, subclause, clause, sentence, subparagraph, paragraph, subdivision, section, or subpart thereof, or to the person or circumstance directly involved in the controversy in which such judgment shall have been rendered.

Part 700.11 Effective Date

This Part shall take eﬀect on the 180th day after publication in the State Register.