Law / United States / 
New York
S7695B, New York Child Data Protection Act
N.Y. Gen. Bus. Law art. 39-FF, sections 899-EE to 899-MM (2024 N.Y. Laws ch. 121)
In force since .
An age-appropriate design code rule binding private bodies.
- Private right of action
- No
- Penalties
- Up to $5,000 per violation, plus injunctive relief, restitution, and disgorgement.
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Produced on request
What it requires
- Applies to operators of websites, online services, apps, and connected devices directed to or reasonably likely to be used by minors.
- Do not process, sell, or share the personal data of a user under 18 for targeted advertising, profiling, or other non-essential purposes without informed consent.NIST Privacy FrameworkCT.PO-P1
- Honor browser or device signals indicating that a user is a minor.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text. Also read by: New York State Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
New York Attorney General
Settledness
- As of
- Guidance link
- https://ag.ny.gov/sites/default/files/2025-05/nycdpa-guidance.pdf
- Guidance body
- New York State Office of the Attorney General
- Open questions
- Which characteristics make a device's "age flag" one an operator must respect under General Business Law section 899-ii(1), when the Attorney General has said it will promulgate rules on them and will exercise discretion in pursuing enforcement on that provision until the rules are in effect?
What it reaches
Age threshold
18
Covered services
Websites, online services, apps, and connected devices directed to or reasonably likely to be used by minors
How the hook was established
express
What makes it apply
Place of effect
Verification methods
Device signal
What it makes you log
Who may demand the log
Counterparty
Logging duty
A processor must provide the operator evidence of each deletion within thirty days, make available the information needed to show its compliance, and allow assessments by the operator or an independent assessor, which cannot be done without records. The operator's own duties in sections 899-ff and 899-ii name no log or record.
- Kind
- Implicit
- As of
- Provision
- N.Y. Gen. Bus. Law 899-gg(3), (4) and (5)(c) and (d)
- Trigger
- personal_data_processing
What this law does
Operators of websites, online services, apps, and connected products may not process, sell, or share the personal data of a user under 18 for targeted advertising, profiling, or other non-essential purposes without informed consent, and must honor browser or device signals indicating a user is a minor. The Attorney General has said it will exercise enforcement discretion for good-faith compliance efforts while final implementing rules remain pending.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .