Law / United States / 
New York
S4609A/A6549A Stop Online Predators Act, enacted as the Safe by Design Act (FY2027 budget, S9008-C part Y)
N.Y. Gen. Bus. Law art. 45-B, sections 1539-1547 (2026 N.Y. Laws ch. 58, part Y)
An age-appropriate design code rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to online platforms likely to be used by minors, including social media, gaming, and digital messaging platforms.
- Apply privacy-protective default settings for users you know are minors, including restricting contact and profile recommendations from unknown adults and limiting financial transactions.NIST Privacy FrameworkGV.PO-P2
- Require parental approval before a minor weakens those default settings.NIST Privacy FrameworkCT.PO-P3
- Turn AI companion features off by default for users you know are minors.no control in the NIST Privacy Framework
- Determine whether a user is a minor through age assurance, never self-declaration of age, using the methods the Attorney General's rules accept; where those rules are not in effect, use a reasonable method that guards against circumvention, minimizes the retention of the information collected, and is offered alongside at least one other method, one of which does not rely on government issued identification or lets the user stay anonymous to the operator.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P5Data are destroyed according to policy.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
New York Attorney General
Settledness
- As of
- Open questions
- Which age assurance method is a "reasonable age assurance method" under General Business Law section 1540(1)(c), when the Attorney General's rules referred to in section 1540(1)(a) and (b) are not in effect and self-declaration of age is barred?
- What makes a method one that "allows a covered user to maintain anonymity as to the operator" under General Business Law section 1540(1)(c)(iii), so that it meets the requirement of at least one method that does not rely on government issued identification?
What it reaches
Covered services
Online platforms likely to be used by minors, including social media, gaming, and digital messaging platforms
How the hook was established
express
What makes it apply
Place of effect
What it makes you log
Log retention
Applies until the Attorney General's rules under section 1540(1)(a) are in effect and article 45's rules do not apply.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Information collected for age assurance purposes, beyond what a reasonable age assurance method minimizes
Logging duty
The article requires age assurance and names no log, record or proof of the check. Section 1540(1)(a) lets the Attorney General's rules require deletion after an attempt, and section 1540(1)(b) points an operator to the methods that article 45 and its implementing rules require, whose record duties belong to article 45 and its rules.
- Kind
- None
- As of
- Provision
- N.Y. Gen. Bus. Law 1540(1) and (2)
What this law does
Covered online platforms, including social media, gaming, and digital messaging services, must apply privacy-protective default settings for users they know are minors, including restricting contact and profile recommendations from unknown adults, limiting financial transactions, requiring parental approvals for weaker settings, and turning AI companion features off by default.
The act requires age assurance, never self-declaration of age, using the methods the Attorney General's rules accept and, until those rules are in effect, a reasonable method that guards against circumvention, and was enacted in May 2026 as part Y of the state's FY2027 transportation and economic development budget bill.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .