New York Attorney General Letitia James has released the final rules implementing the state’s SAFE for Kids Act, establishing how social media companies must limit addictive features for users under 18.
The regulations outline how platforms must comply with the law, which requires companies to restrict algorithmically personalized content feeds and overnight notifications for minors unless they receive parental consent.
The SAFE for Kids Act was championed by James, sponsored by State Sen. Andrew Gounardes and Assemblymember Nily Rozic, and signed into law by Gov. Kathy Hochul.
Under the law, social media companies must provide users under 18 with non-algorithmic feeds by default. Instead of content selected by algorithms designed to maximize engagement, minors will see posts from accounts they follow or choose, presented in a set order such as chronological order. Parents may choose to allow algorithmically personalized feeds by providing consent.
The law also prohibits social media platforms from sending push notifications to users under 18 between midnight and 6 a.m. without parental permission.
Attorney General James said the rules establish standards for age verification and parental consent while requiring technology companies to better protect children online.
“The SAFE for Kids Act leads the nation in keeping our children safe online and protecting youth from the devastating effects of unchecked social media,” James said. “These rules set standards for age verification and parental control to ensure tech companies are doing their part to keep kids safe on their platforms.”
Governor Hochul said the regulations send a message that children’s mental health takes priority over technology companies’ business interests.
Supporters of the law point to research linking algorithmically curated social media feeds to increased risks of depression, anxiety, eating disorders and sleep problems among children and teenagers. According to the Attorney General’s Office, personalized recommendation systems are designed to encourage users to spend more time on platforms by continuously serving content based on their activity and preferences.
The new rules establish which social media companies are covered by the law and how they must determine a user’s age and obtain parental consent before enabling algorithmically personalized feeds or overnight notifications for minors.
State officials said users under 18 will continue to have access to the same content available on the platforms, but without recommendation algorithms unless parental permission is granted. The regulations are intended to reduce excessive social media use while preserving access to online services.
Age Assurance
- For users above the age of 17, social media companies must determine that the user is an adult before allowing them to access algorithmic feeds and/or nighttime notifications. Companies may confirm a user’s age using any existing method, as long as the methods are shown to meet accuracy benchmarks and protect users’ data. Companies can use options such as:
- Requesting an uploaded image or video; or
- Verifying a user’s email address or phone number to cross-check other information that reflects a user’s age.
- Social media companies must offer at least one alternative method for age assurance besides providing a government-issued ID.
- Any information used to determine age or obtain parental consent must not be used for any other purpose and must be deleted or de-identified immediately
after its intended use. Social media companies must use only the minimum amount of data necessary to confirm a user’s age. - Minor users must have an option to update their age status on the platform when they turn 18.
- Social media companies must choose an age assurance method with a high accuracy rate, conduct annual testing, and retain the results of the testing for a minimum of five years.
Parental Consent
- Minors must affirmatively seek access to prohibited features and must consent to their parent being notified. Any parent who wants to grant consent must go through age assurance.
- The platform may not block a minor user from generally accessing the platform or its content through, for example, searches, simply because they or their parent has refused to consent.
- The platform is not required to show parents the user’s search history or topics of interest to obtain parental consent.
- Parents and minors must also have the option to withdraw their consent at any time.
The SAFE for Kids Act and rules apply to “Addictive Online Platforms,” defined as platforms that display user-generated content and have users who spend at least 20 percent of their time on the platform’s addictive feeds.
