Operates a social platform, in New York

N.Y. Gen. Bus. Law section 899-bb (Article 39-F, added by L. 2019, ch. 117 (S5575-B/A5635-B), section 4) · Read the law's page

• This binds any person or business that owns, licenses, or maintains computerized data including the private information of a New York resident; a business already a compliant regulated entity under Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or 23 NYCRR Part 500 (the New York Department of Financial Services cybersecurity regulation for a financial-services licensee) is deemed to comply.
• Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).
• A small business, fewer than 50 employees, under $3,000,000 in gross annual revenue in each of the last three fiscal years, or under $5,000,000 in year-end total assets, may scale its program's administrative, technical, and physical safeguards to its own size, complexity, and the sensitivity of the personal information it collects.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of General Business Law 349, seeking injunctive relief and a civil penalty of up to $5,000 per violation under General Business Law 350-d.

N.Y. Gen. Bus. Law art. 45-A (proposed §§ 1510-1513), S6954-B / A6540 · Read the law's page

• Embed machine-readable provenance data in synthetic content you create or modify with a generative AI system, identifying it as synthetic.
• If you operate a social media platform, do not delete, disassociate from, or degrade the provenance data attached to content a user uploads.

N.Y. Gen. Bus. Law art. 45-B, sections 1539-1547 (2026 N.Y. Laws ch. 58, part Y) · Read the law's page

• Applies to online platforms likely to be used by minors, including social media, gaming, and digital messaging platforms.
• Apply privacy-protective default settings for users you know are minors, including restricting contact and profile recommendations from unknown adults and limiting financial transactions.
• Require parental approval before a minor weakens those default settings.
• Turn AI companion features off by default for users you know are minors.
• Determine whether a user is a minor through age assurance, never self-declaration of age, using the methods the Attorney General's rules accept; where those rules are not in effect, use a reasonable method that guards against circumvention, minimizes the retention of the information collected, and is offered alongside at least one other method, one of which does not rely on government issued identification or lets the user stay anonymous to the operator.

N.Y. Gen. Bus. Law art. 45, sections 1500-1508 (2024 N.Y. Laws ch. 120) · Read the law's page

• Applies to social media platforms providing algorithmically personalized (addictive) feeds to users in New York.
• Obtain parental consent before providing an addictive, algorithmically personalized feed to a user you know is a minor.
• Do not send notifications to a minor between midnight and 6 a.m. without parental consent.
• Use the age-determination and parental-consent methods the Attorney General's rules identify as acceptable.