Law / United States / 
New York
S7694A/A8148A, Stop Addictive Feeds Exploitation (SAFE) for Kids Act
N.Y. Gen. Bus. Law art. 45, sections 1500-1508 (2024 N.Y. Laws ch. 120)
A social media and minors rule binding private bodies.
- Private right of action
- No
- Penalties
- Up to $5,000 per violation, enforced by the Attorney General.
- Audit expectation
- periodic
- Who audits it
- Registered or designated auditor
- Where the report goes
- Kept
What it requires
- Applies to social media platforms providing algorithmically personalized (addictive) feeds to users in New York.
- Obtain parental consent before providing an addictive, algorithmically personalized feed to a user you know is a minor.NIST Privacy FrameworkCT.PO-P1
- Do not send notifications to a minor between midnight and 6 a.m. without parental consent.no control in the NIST Privacy Framework
- Use the age-determination and parental-consent methods the Attorney General's rules identify as acceptable.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: New York State Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
New York Attorney General
Settledness
- As of
- Guidance link
- https://ag.ny.gov/safe-for-kids-act-final-rule
- Guidance body
- New York State Office of the Attorney General
- Open questions
- How is the "time spent by monthly active users" on addictive feeds counted under 13 NYCRR 700.1(d) in deciding whether 20 percent or more of it is spent on addictive feeds: as total time across all users, or as an average per user?
- Is a platform an "addictive online platform" under 13 NYCRR 700.1(d) if 20 percent or more of user time is spent on addictive feeds in one six-month period of the prior calendar year but not in another, or may the platform choose the period it measures?
What it reaches
Age threshold
18
Covered services
Social media platforms providing algorithmically personalized (addictive) feeds to users in New York
How the hook was established
express
What makes it apply
User location
What it makes you log
What the log must hold
Event time, Age assurance result
Log retention
Test results, reports and certifications are kept for at least 10 years (13 NYCRR 700.5(d)).
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
- Prohibits retaining
- Data collected to comply with the rules, held longer than the minimum time necessary, other than the records the rules require an operator to keep
Logging duty
The statute bars keeping age-determination information after an attempt (section 1501(3)). The Attorney General's rules require a covered operator to keep, for at least 5 years, the fact that an age assurance method was attempted, the method that confirmed age status, its date and the user's age status, and to keep certification test results, reports and certifications for at least 10 years. The rules take effect on the 180th day after publication in the State Register.
- Kind
- Explicit
- As of
- Provision
- 13 NYCRR 700.7(b) and 700.5(d), adopted under N.Y. Gen. Bus. Law 1505
- Trigger
- age_assurance
What this law does
Social media platforms must obtain parental consent before providing an addictive, algorithmically personalized feed to a user they know is a minor, and may not send notifications to minors between midnight and 6 a.m. without parental consent. The Attorney General's final rules were announced on , and the act goes into effect 180 days after their publication in the State Register, on .
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .