New York Finalizes Its SAFE for Kids Act Rules, and the Fight Is Just Starting

New York's attorney general and governor spent two years writing a rulebook nobody had built before. On July 28, 2026, Attorney General Letitia James and Governor Kathy Hochul released the final implementing rules for the SAFE for Kids Act, according to a joint announcement from the Attorney General's office and the Governor's office. The rules take effect January 25, 2027, 180 days after publication.

That gap matters. The underlying law, the Stop Addictive Feeds Exploitation for Kids Act, was signed by Governor Hochul in June 2024. But a law telling regulators to write rules is not a law that does anything on its own. For two years, platforms waited to learn what an addictive feed would mean in practice, and how a company was supposed to prove a user's age without becoming a data collector itself. Now there is an answer, with a deadline parents can circle on a calendar.

What changes for a New York family in January 2027

Strip away the statutory language and the rule does three concrete things to a minor's account on a covered platform.

First, the default feed flips. Without parental consent, a user under 18 sees only posts from accounts they already follow, shown in the order they were posted. No algorithm decides what shows up next.

Second, nighttime notifications go dark. Platforms must block push notifications to minors between 12 a.m. and 6 a.m. unless a parent has consented otherwise, per the final rule summary published by the Attorney General's office on July 28, 2026.

Third, nothing turns on without an age check. A platform cannot offer the algorithmic feed or nighttime alerts to anyone who might be 17 or younger until it verifies they are an adult, or until a parent affirmatively opts them in. The rule spells out the mechanics of that opt-in:

• The minor, not the platform, has to request the restricted feature first.
• The parent then completes an age assurance step of their own before consent counts.
• Either the parent or the child can revoke consent at any time, and the platform has to honor it.
• A platform cannot lock a minor out of the app entirely just because a parent declines consent. All content stays reachable. Only the algorithmic delivery and the 2 a.m. ping go away.

None of this touches what a teenager can post or read. A 15 year old can still find and follow whatever accounts she wants. What disappears, absent a parent's sign off, is the recommendation engine deciding what she sees next.

The age verification problem nobody has fully solved

Here is the part that makes privacy lawyers nervous, and the part the rule tries hardest to address. To know whether a user needs the restricted default, a platform has to know whether that user is under 18. That means collecting some proof of age from millions of accounts that never asked to hand one over.

The final rule allows several verification paths rather than mandating one. Accepted methods include an uploaded photo or video for an age estimate, or a cross check against an email address or phone number tied to age data a company already holds, according to the Attorney General's July 28, 2026 rule summary. The rule requires platforms to offer at least one method that does not depend on a government issued ID, so a driver's license does not become the default password for using social media as an adult.

The rule's answer to the obvious follow up question, what happens to all that verification data, is blunt. It has to be deleted or de identified immediately after use, and a platform can only collect the minimum needed to answer the age question, not for advertising or profile building. Whether the deletion promise holds up in practice is an open question. Age verification systems built for comparable laws elsewhere have drawn criticism from digital rights groups for exactly the failure mode New York is trying to design around: a system meant to protect privacy that ends up creating a new pile of sensitive data to protect. New York's rule addresses the concern on paper. Whether regulators can audit deletion once the rule is live is a different, harder problem.

Why the 20 percent threshold is the fight beneath the fight

The rule does not regulate every website with a comment section. It applies to what it calls an Addictive Online Platform, defined as a service displaying user generated content where users spend at least 20 percent of their time in a feed that is algorithmically personalized rather than chronological or manually curated.

That number is doing enormous work. Twenty percent is low enough to sweep in the largest social apps without much argument, and vague enough to invite a fight over measurement. Twenty percent of whose time, measured how, over what window? A platform with a mixed experience, part feed, part messaging, part search, could argue its algorithmic share sits under the line depending on how the clock runs. Expect compliance lawyers to spend the rest of 2026 building usage models favorable to their clients, and the Attorney General's office to push back on whichever models look too convenient.

The legal fight New York is walking into

New York is not the first state to try this, and industry pushed back quickly. NetChoice, the trade group that represents Meta, Google, and TikTok in litigation nationwide, called the final rules unconstitutional and pointed to laws in other states that courts have blocked.

The record NetChoice points to is real, but it cuts both ways. In NetChoice v. Griffin, a federal court in Arkansas permanently blocked that state's social media age verification law in 2025, finding it likely violated the First Amendment because it gated access to an entire platform behind an ID check. That is the loss NetChoice wants New York to worry about.

The more comparable case may be California's. In NetChoice v. Bonta, a Ninth Circuit panel split the difference in a 2025 ruling. The court upheld California's requirement that minors get parental consent before receiving an algorithmically curated feed, applying intermediate scrutiny and finding the restriction reasonably tied to the state's interest in protecting children online. In the same ruling, the panel struck down a separate provision on other grounds. New York's feed default rule looks more like the part of California's law that survived than the part that fell, or than Arkansas's blanket verification gate. That does not make it safe from challenge, and the harder question, whether a mandatory age verification step bolted onto an otherwise surviving feed restriction changes the constitutional analysis, has not been settled by any appeals court yet.

Why other states are watching

New York built something most other states did not have going in: an attorney general with rulemaking authority to define the details after the legislature passed a broad statute. That let the rule get specific, on the feed default, the notification window, the verification methods, the deletion requirement, without sending the whole package back to the legislature for a rewrite.

If it survives a First Amendment challenge, or simply goes unchallenged through January 25, 2027, it becomes the language other states reach for. Legislators drafting their own kids online safety bills tend to borrow text that has already cleared a court. If it falls instead, that outcome gets studied just as closely, by the same legislators, before their next session starts.

This article is general information about a New York regulatory rulemaking, not legal advice. Parents, platforms, and anyone facing a compliance decision under the SAFE for Kids Act should consult a licensed attorney about their specific situation. Questions go through our contact page.