New York Finalizes Act to Restrict Addictive Social Feeds for Minors
On July 28, the New York Office of the Attorney General issued final rules implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act. The law takes effect on January 25, 2027, and applies to online platforms defined as “addictive social media platforms.”
Under the statute, these platforms must restrict the provision of an “addictive feed” and nighttime notifications to minor users unless they first obtain verifiable parental consent. The final rules clarify key definitions, age-assurance standards, consent processes, and recordkeeping obligations.
An addictive social media platform is one where 20% or more of the time spent by monthly active users occurs on addictive feeds, measured over any six-month period. An “addictive feed” consists of multiple pieces of media that are shared or generated by users and then recommended, selected, or prioritized for display based on information persistently associated with the user or device, or on the user’s previous interactions with user-generated content. This can include interactions across different platforms. Certain activities are excluded from the definition, such as recommendations responding to a search query, responses to express and unambiguous requests for specific media, recommendations based on privacy or accessibility settings, and the display of private communications.
The rules set detailed standards for age assurance. At least one age-assurance method, as well as an appeal process, must not require a government-issued ID. Each method must be certified annually against accuracy requirements. Certification involves testing for false positive rates, rates of inconclusive outcomes, false negative rates, detection of circumvention attempts, data collection and deletion practices, encryption and security measures, and overall accuracy thresholds.
When a user is identified as a minor, operators must obtain verifiable parental consent before providing a covered feed or nighttime notifications. The process requires operators to notify the minor that these features cannot be provided without parental consent and to obtain the minor’s consent to contact the parent. Operators must then notify the parent and provide a method for granting consent. Both minors and parents must have a simple, accessible way to withdraw consent at any time.
Recordkeeping requirements are also specified. Operators must retain copies of all age-assurance test results, reports, and certifications for at least 10 years. Additional records related to individual age determinations—such as attempts made, successful methods used, dates of determination, age status outcomes, and monthly aggregate data on usage of each method—must be kept for at least five years where applicable.
The rules provide the operational framework for platforms that fall within the law’s scope as they prepare for the January 2027 effective date.
