On July 28, 2026, the New York Office of the Attorney General released final rules (the “Rules”) implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which goes into effect on January 25, 2027.

The SAFE for Kids Act requires online “addictive social media platforms,” which are defined as websites, online services, and applications that offer an “addictive feed” as a significant portion of their services, to restrict providing an “addictive feed” and nighttime notifications for minor users unless they obtain verifiable parental consent.

The Rules establish detailed requirements, including age-assurance standards and parental-consent mechanisms. Some of the key provisions of the Rules are described below:

• Scope and Applicability. The Rules interpret the “significant portion” standard of the statute’s “addictive social media platforms” definition to mean an online platform where 20% or more of time spent by monthly active users is spent on “addictive feeds” measured over any six-month period. An “addictive feed” is defined to mean an online platform, or portion thereof, in which multiple pieces of media are shared or generated by users, and concurrently or sequentially, recommended, selected, or prioritized for display to a user based on (1) information persistently associated with the user or the user’s device; or (2) the user’s previous interactions with user-generated content including the user’s interactions on different online platforms, media, or the pages, groups, or other user-generated media the user requests, subscribes to, or otherwise selects. Certain conduct is excluded from the definition of “addictive feed,” including recommendation in response to a search inquiry, recommendation in response to express and unambiguous requests for certain media, recommendation based on privacy and accessibility settings, and display of private communications.

• Age Assurance Standards. At least one method for both age assurance and an appeal must not require a government-issued ID. However, each method must be certified annually to meet the accuracy standards set forth in the Rules, which set a high bar. The certification process involves testing of false positive rates; rate of inconclusive age assurance outcomes; false negative rates; detection of method circumvention; data collection, segregation, and deletion measures; data encryption and security measures; and, determination of whether it meets the accuracy minimum and total accuracy minimum.

• Verifiable Parental Consent Requirements. If a user is a minor, operators must obtain verifiable parental consent before providing the covered feed or nighttime notifications. The Rules contain prescriptive consent requirements. First, the operator must provide notice to the minor that they cannot provide the minor a covered feed or nighttime notifications without verifiable parental consent, and must obtain valid consent from the minor to request verifiable parental consent. Second, the operator must provide the parent with notice that the operator cannot provide the minor certain features without verifiable parental consent, and offer the parent access to a method of providing consent. Operators must provide minors and parents a simple, accessible mechanism to withdraw consent at any time.

• Recordkeeping requirements.  The Rules also impose certain recordkeeping obligations on operators. As part of the certification process for age assurance methods, operators must maintain copies of all test results, reports, and certifications generated in compliance for no less than 10 years. Operators must also maintain records for no less than 5 years, where applicable: (1) the fact that an age assurance method was attempted on a user; (2) the age assurance method that successfully confirmed age status; (3) the date when the determination of age status was conducted; (4) the user’s age status; (5) information collected for compliance with these requirements; and, (6) data related to each age assurance method utilized on a month-by-month basis (e.g., total number of covered users: who attempted to confirm age status using that method; were successfully age-determined; were reclassified from adult to minor status; and, were denied adult status due to method circumvention).