New York's Stop Addictive Feeds Exploitation for Kids Act finally has an enforcement clock attached to it. On July 28, 2026, Governor Kathy Hochul and Attorney General Letitia James announced the release of final implementing rules for the SAFE for Kids Act, the 2024 law that restricts algorithmically personalized feeds and nighttime notifications for users under 18 unless a parent consents. The rules take effect 180 days after their State Register filing, putting the real compliance deadline at January 25, 2027.
Source: New York Governor's official press release, captured August 8, 2026.
How the rules got here
The SAFE for Kids Act itself is not new. Hochul signed it in June 2024, and the statute authorized the Office of the Attorney General to write the rules that would actually define compliance before the law's obligations kicked in. OAG opened that process with an advance notice of proposed rulemaking on August 1, 2024, followed by a 60-day public comment window. A full proposed rule went out for review on September 15, 2025, and OAG says it incorporated public input, industry research, and its own enforcement experience before finalizing the text released this week.
That two-year gap between signing and final rules explains why this announcement is the real trigger for businesses, not the 2024 signing. A law with no defined compliance mechanism is not yet something a platform operator can act on. A final rule with a dated 180-day countdown is.
What counts as an addictive online platform
The rules narrow who has to comply. They apply to what the statute calls an "Addictive Online Platform," defined as a platform that displays user-generated content where users spend at least 20 percent of their time on the platform's algorithmically personalized feeds, measured over a six-month period. That threshold matters because it pulls in mainstream social platforms while leaving plenty of user-generated-content sites outside the law's reach if personalized feeds are not where most of the engagement happens.
For a covered platform, two obligations kick in for any user it cannot verify as an adult: it must stop showing that user an algorithmically personalized feed, defaulting instead to content the user actually follows or selects, in a set order such as chronological, and it must stop sending notifications between midnight and 6 a.m. Both restrictions lift only if the platform obtains parental consent through the age-assurance process described below. A minor who does not have, or does not want, that consent still gets full access to the platform's content, just not the personalized feed or overnight notifications.
Age assurance: what the rules actually require
The rules give platforms flexibility on method but not on outcome. A platform has to determine a user is an adult before it can turn on algorithmic feeds or nighttime notifications for that account, and it can do that through options including an uploaded image or video, or by verifying an email address or phone number against other information that reflects age. Whatever method a platform picks, it must also offer at least one alternative to a government-issued ID, so ID upload cannot be the only path to adult status.
The data-handling side of the requirement is where a business's own privacy disclosures start to matter. Any information collected to determine age or secure parental consent cannot be reused for another purpose, and it has to be deleted or de-identified immediately after that one intended use. Platforms are required to use only the minimum data necessary to confirm age, run annual accuracy testing on whatever method they choose, and keep those test results for at least five years. A minor also has to be able to update their own age status once they turn 18.
Parental consent has its own limits
Consent is opt-in and structured around the minor, not the parent, initiating the process. A minor has to affirmatively seek access to the restricted features and agree to have a parent notified before that parent can grant consent, and the parent has to go through the same age-assurance process to do so. Refusal cannot become a lockout: a platform may not block a minor from generally accessing its content, including through search, just because consent was refused or never sought. Both the parent and the minor can withdraw consent at any time.
| Milestone | Date |
|---|---|
| SAFE for Kids Act signed into law | June 2024 |
| OAG advance notice of proposed rulemaking | August 1, 2024 |
| Proposed rules published for public comment | September 15, 2025 |
| Final rules announced | July 28, 2026 |
| Final rules filed in the State Register | July 29, 2026 |
| Compliance deadline (180 days later) | January 25, 2027 |
Enforcement is not symbolic. OAG can bring an action to stop violations and seek civil penalties of up to $5,000 per violation, on top of other remedies available under the statute.
What this means for your privacy policy
If your platform meets the 20 percent addictive-feed threshold and reaches New York users, the January 25, 2027 deadline is a real disclosure problem, not just a product one. You will be collecting new categories of data (age-verification inputs, parental consent records, consent-withdrawal events) and applying a new retention rule to them (delete or de-identify immediately after the age or consent determination is made). A privacy policy that does not yet describe an age-assurance data flow, who can consent on a minor's behalf, and how quickly that verification data is discarded has a gap the rules just created. Our Privacy Policy Generator helps you document exactly what data your age-assurance and parental-consent flow collects, how long you keep it, and who it is shared with, so your public disclosures keep pace with a compliance mechanism you did not have to describe six months ago.
New York's own framing of this announcement is worth noting for context: officials cited a national ranking placing the state first for technology laws protecting kids online, and the SAFE for Kids Act sits alongside other recent state measures aimed at minors, from the EU's parallel scrutiny of default privacy settings for minors on TikTok to the age-verification and parental-consent regime Texas is now enforcing at the app-store level. Businesses that already built an age-assurance flow for one of those regimes are closer to SAFE for Kids compliance than they might assume, but the specific 20 percent engagement threshold, the midnight-to-6-a.m. notification cutoff, and the immediate-deletion rule for verification data are New York-specific mechanics that need their own line in a privacy policy, not a borrowed paragraph from a different state's law.
The bottom line
The compliance date to put on a calendar is January 25, 2027, 180 days after the July 29, 2026 State Register filing, not the June 2024 signing date some coverage will still reference. Between now and then, any business running an addictive-feed platform that reaches New York users under 18 needs an age-assurance method that meets the accuracy and data-minimization rules above, a parental-consent flow that lets a minor initiate and a parent (or the minor) withdraw at will, and a privacy policy that says so in plain terms. For background on how these mechanics compare with the app-store-level age verification already in force in Texas and the broader children's-privacy landscape, see our roundup of child privacy compliance data for 2026.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
