New York has finalized age-assurance rules for the SAFE for Kids Act, defining how covered social media platforms must distinguish adults from minors before providing algorithmic feeds or overnight notifications.
The rules take effect January 25, 2027, 180 days after their publication in the State Register. The attorney general can seek civil penalties of up to $5,000 per violation.
Platforms may use methods including an uploaded image or video, or a cross-check using an email address or phone number. They must provide at least one option that does not require a government-issued identity document, limiting the risk that compliance makes official ID the default condition for social media access.
The final rules also impose data-handling restrictions. Information collected for age assurance must be deleted promptly or converted into a de-identified form, and platforms are expected to minimize the data they request and retain. Those limits apply regardless of which technical method a service selects.
Covered services must test their methods against accuracy requirements, document the results and retain compliance records for ten years. The framework is intended to make age determination measurable rather than allowing platforms to rely solely on a date-of-birth field that a child can change.
The SAFE for Kids Act targets two product features. Platforms cannot provide a minor with an algorithmically selected feed without parental consent, and they must restrict overnight notifications during specified hours. Age assurance determines which accounts receive those protections.
New York’s approach fits a wider US effort to set privacy boundaries around online age checks. The Federal Trade Commission has created a COPPA enforcement safe harbor for age-verification data collected under defined limits, while vendors are developing document and facial age-assurance options for platforms facing new legal duties.
The rule does not require one particular technology. That method-neutral structure lets platforms choose among documentary, biometric and account-based approaches, but it also puts weight on testing, alternatives and deletion controls to keep those choices accountable.
Implementation will now shift to the platforms. They have roughly six months to select methods, build consent and appeal processes, validate accuracy and document how age-assurance data is separated from advertising or unrelated profiling.
Sources: New York Attorney General
–
By the ID Tech Editorial Team
