Regulationsby GlyphNY SAFE for Kids Act
Enacted New York · In force Jan 25, 2027 · next deadline Jan 25, 2027 (in 3 months)
Deadlines
Coming up
Act and rules take effect180 days after State Register publication.
Already passed
Rules published in State RegisterStarts the 180-day clock.
Final SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.
Signed by GovernorChapter 120 of 2024.
Summaries for reference, not legal advice. Check the official text.
What it does
Social media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.
- Who it applies to
- Addictive online platforms (user-generated content where users spend at least 20 percent of time on addictive feeds) serving New York users.
- Penalties
- Civil penalties up to $5,000 per violation, plus injunctions.
- Enforced by
- New York Attorney General
- Official name
- Stop Addictive Feeds Exploitation (SAFE) for Kids Act
- Citation
- L. 2024, ch. 120; N.Y. Gen. Bus. Law Article 45; 13 NYCRR Part 700
- Topics
- Children, Online safety
Related
Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 monthsCalifornia Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 monthsCalifornia SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 monthsCalifornia SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months
Colorado Privacy Act (CPA)Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.In effect since Jul 1, 2023
Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months
Delaware Personal Data Privacy Act (DPDPA)Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.Next: Jan 1, 2027 Amended thresholds and third-party duties take effect · in 2 months
Questions about NY SAFE for Kids Act
- What are the NY SAFE for Kids Act compliance deadlines?
- Jun 20, 2024: Signed by Governor. Jul 28, 2026: Final SAFE for Kids rules released. Jul 29, 2026: Rules published in State Register. Jan 25, 2027: Act and rules take effect.
- When does NY SAFE for Kids Act take effect?
- NY SAFE for Kids Act takes effect on Jan 25, 2027. The next milestone is Jan 25, 2027: Act and rules take effect.
- Who does NY SAFE for Kids Act apply to?
- Addictive online platforms (user-generated content where users spend at least 20 percent of time on addictive feeds) serving New York users.
- What are the penalties under NY SAFE for Kids Act?
- Civil penalties up to $5,000 per violation, plus injunctions.