New York SAFE for Kids Act: how to prepare for the January 2027 age assurance requirements
In July 2026, New York’s SAFE for Kids Act became the first US state law to release final implementing rules centered on restricting addictive social media feeds for minors without parental consent. Taking effect on January 25, 2027, the rules set specific accuracy thresholds, require annual third-party certification, establish privacy requirements, and give users alternatives to government ID.
To prepare, companies need to determine whether the law applies, establish whether users are minors or adults, offer compliant age assurance methods, handle inconclusive outcomes and appeals, and retain evidence that each method was tested and certified. This guide explains those requirements and the decisions legal, compliance, product, and trust and safety teams need to make.
Does the NY SAFE for Kids Act apply to my online platform?
Your platform may be covered if it provides an addictive feed as a significant part of its service and does not qualify for an exemption. The rules use the term “covered operator” for the person or organization that operates or provides the platform, including certain agents and affiliates. For readability, this article generally uses “platform.”
Consider the following three questions to help you determine whether these requirements apply.
Does my platform provide an addictive feed?
To answer this question, it’s important to understand what an “addictive online platform” is. The rules define it based on user time spent on addictive feeds.
What’s an addictive feed? An addictive feed generally involves user-generated or user-shared media and recommends, selects, or prioritizes content based on information persistently associated with the user, the user’s device, or the user’s previous interactions. The law excludes several experiences, including feeds not ordered on user-associated information, direct and private communications, content displayed only in response to a specific search, and content from accounts or groups the user expressly chooses to follow.
The law applies only when addictive feeds are a significant part of the platform. Under Section 700.1(d), a feed is considered a significant part of the platform when users spend at least 20% of their total time on the platform viewing addictive feeds. Platforms may calculate the 20% threshold over any one six-month period they select from the prior calendar year.
Since the platform chooses the measurement period, it should also document the dates it selects, how it defines monthly active users, and how it calculates time spent across feed types. See the final rule’s definitions for the complete criteria and exclusions.
Does my platform qualify for an exemption?
A platform that meets the addictive-feed definition may still be exempt from the rule’s requirements if it has:
Fewer than five million monthly active users
Fewer than 20,000 monthly active users who are covered minors
A platform whose primary user base consists of minors does not qualify for the exemption, even if it falls below one of those user-count thresholds.
What happens if my platform loses its exemption status?
Platforms that lose their exempt status under Section 700.2(c) must respond in one of two ways:
The first time a platform stops qualifying for the exemption, it generally has 180 days to comply.
If the platform later regains and loses exempt status again, it generally has 30 days to comply after each subsequent loss of the exemption.
These platform-specific grace periods do not change the January 25, 2027 effective date for the final rules. Compliance teams should monitor total monthly active users and covered minors, record when the platform’s exemption status changes, and calculate the resulting deadline.
When does the NY SAFE for Kids Act take effect?
The final rules become enforceable on January 25, 2027. They were published in the New York State Register on July 29, 2026, and Part 700 takes effect 180 days after publication.
The rules require platforms to obtain annual certification for every age assurance method it offers. An accredited third party must confirm that the method meets an accepted industry standard, the Accuracy Minimum, and the rule’s testing requirements. If the method has adjustable settings or options, the platform may use only the configurations covered by the certification.
Start with the effective date and build a workback plan for testing, certification, vendor evaluation, and implementation. The final rules require platforms to retain test results, reports, and certifications for at least 10 years.
What age assurance methods does the NY SAFE for Kids Act recognize?
The rules recognize three types of age assurance methods: age estimation, age inference, and age verification. Whether the platform offers one method or multiple methods, each method must meet the applicable certification and accuracy requirements.
Additionally, each age assurance method must be certified by an accredited third party against the Accuracy Minimum, which defines how often the method incorrectly classifies a minor as an adult. At least one offered method must also meet the Total Accuracy Minimum, which counts both false positives and inconclusive outcomes.
What are notable requirements of the NY Safe for Kids Act?
Government ID and alternative methods for age verification
Although government ID is a very common age assurance method, the SAFE for Kids Act doesn’t require it for age verification. In fact, the rules prohibit most platforms from making it the only available path. If a platform does offer government ID verification, it generally must also offer at least one alternative method.
The rules address alternatives to government ID in three parts of the user journey:
Age assurance: A platform that offers government ID verification must also offer a non-government-ID method. This requirement does not apply if the platform necessarily collects or possesses the ID to comply with another law or offers a zero-knowledge proof age assurance method (Section 700.4(c)(3)).
Parental consent: The consent flow must include at least one option that does not require the parent to provide government ID, unless the platform already holds the ID for another legal purpose and obtains consent to use it for parental consent (Section 700.2(e)(5)(vi)).
Appeals: Users who appeal a minor classification must be able to submit at least one form of documentation other than government ID (Section 700.6(a)(1)).
If a platform chooses to offer government ID, it must accept government-issued identification from all US and non-US jurisdictions. It must also allow a user appeal if every other offered method is inconclusive and the user declines to provide government ID. Platforms should design their age assurance, parental consent, and appeals flows as one connected experience.
Parental consent
Typically, the user normally completes age assurance flows. In a verifiable parental consent flow, the parent also completes age assurance so the platform can determine that the parent is an adult.
Under the SAFE for Kids Act, platforms do not have to offer minors a parental consent path for addictive feeds or nighttime notifications. Instead, they can restrict those features for minors while continuing to provide access to other available platform content.
However, if a platform lets a minor request access to an addictive feed or nighttime notifications, it must also obtain verifiable parental consent. The minor must first consent to the platform contacting the parent. The platform must then determine that the parent is an adult and take reasonable steps to confirm that the person providing consent is the minor’s parent.
The main requirements include:
| Stage | Is it required? | What the platform must do | Rule reference |
|---|---|---|---|
| Offer a parental consent path | No | Decide whether minors can request access to addictive feeds or nighttime notifications through parental consent. | Sections 700.2(b) and 700.3(b) |
| Notify the parent | Yes, if the platform offers the path | Give the minor notice and obtain the minor’s valid consent before contacting the parent. | Sections 700.2(e) and 700.3(e) |
| Confirm the parent | Yes, if the platform offers the path | Determine that the parent is an adult and use a method reasonably calculated to confirm the parental relationship. | Sections 700.2(e)(5) and 700.3(e)(5) |
| Provide a non-ID option | Yes, subject to a limited exception | Offer at least one option that does not require the parent to provide a government ID. | Sections 700.2(e)(5)(vi) and 700.3(e)(5)(vi) |
| Avoid account or purchase requirements | Yes | Offer at least one option that does not require the parent to create an account or buy another product or service. | Sections 700.2(e)(5)(vii) and 700.3(e)(5)(vii) |
| Allow withdrawal | Yes | Make withdrawal at least as easy as granting consent. Do not require a live representative unless one was required to grant consent. | Sections 700.2(e)(2) and 700.3(e)(2) |
| Review the consent method | Yes | Review and update each verifiable parental consent method at least annually. | Sections 700.2(e)(7) and 700.3(e)(7) |
Decide early whether parental consent will be a part of the user experience. That choice affects product experiences, notices, parent and minor journeys, withdrawal, and access controls for both feeds and notifications.
Age assurance accuracy requirements
New York’s SAFE for Kids Act sets two performance standards for age assurance methods:
Accuracy Minimum: This caps the rate of false positives, or when a method incorrectly identifies a minor as an adult. The calculation excludes inconclusive outcomes, user refusals, and failures to provide requested data.
Total Accuracy Minimum: This metric caps the combined rate of false positives and inconclusive outcomes. An inconclusive outcome occurs when the user provides all requested information, the method detects no circumvention, and the method still cannot determine an age or age status. This calculation excludes user refusals and failures to provide requested data.
Both standards use the same age categories and maximum rates. Both also require the method to detect at least 98% of attempts to evade or manipulate the age assurance process.
| Minor’s age | Accuracy Minimum: maximum false-positive rate | Total Accuracy Minimum: maximum false-positive plus inconclusive rate |
|---|---|---|
| 0–7 | 0.1% | 0.1% |
| 8–13 | 1% | 1% |
| 14–15 | 2% | 2% |
| 16 | 8% | 8% |
| 17 | 15% | 15% |
Every offered method must receive annual certification that it meets the Accuracy Minimum. At least one offered method must receive annual certification that it meets the Total Accuracy Minimum. An accredited third party performs the certification and documents the testing protocols and results in a written report.
What happens when age assurance is inconclusive under the NY SAFE for Kids Act?
An inconclusive result does not mean the platform must automatically classify the user as a minor. The platform may presume the user is an adult only when all of the following conditions are met:
The user completes every age assurance method the platform offers, including at least one method that meets the Total Accuracy Minimum.
Every offered method returns an inconclusive outcome.
The platform does not otherwise have actual knowledge that the user is a minor.
This rule affects how platforms design fallback flows. A user must complete every offered method before the platform can apply the adult presumption, so product teams should make the sequence understandable and avoid unnecessary steps.
What can my platform do to prepare for the NY SAFE for Kids Act?
Start by assigning a cross-functional owner and building a workback plan from January 25, 2027. Legal, compliance, product, engineering, privacy, and trust and safety teams will need to make shared decisions regarding coverage, methods, user inventory, including feature usage, and launch timing.
Organize the plan around five questions:
What requirements apply? Confirm whether the platform provides an addictive feed and choose the six-month measurement period. You’ll need to assess whether an exemption applies and identify requirements for notices, consent, data use, deletion, appeals, and record retention.
Where will age assurance occur? Identify the product moments when the platform needs an age status, such as account creation, feed access, notification settings, an appeal, or a report that a user is a minor.
How will the platform manage outcomes? Define adult, minor, inconclusive, pending-consent, consented, appealed, and withdrawn-consent states. Specify which feeds and notifications remain available in each state.
Who owns each decision? Assign responsibility for certification review, provider management, user investigations, appeals, status changes, data controls, and documentation.
When must each milestone be complete? Set dates for coverage analysis, provider selection, certification validation, implementation, testing, legal review, launch, and annual recertification.
How Persona supports age assurance programs
Persona is a configurable identity platform that helps organizations build age assurance experiences using age estimation, age inference, and age verification. Persona has worked with companies such as Reddit, OpenAI, Vimeo, CharacterAI, and Substack on age assurance programs for global user bases. Lime also uses Persona to deploy custom age assurance flows for international requirements.
For any age assurance programs product and compliance teams must balance regulatory requirements with privacy and conversion. They also need control over which methods users see, when to request more information, and how long the underlying data is retained. Persona supports these goals by helping teams:
Reduce friction with layered methods. Start with a lower-friction method, such as age inference or selfie age estimation, and request a higher-assurance method only when the earlier result requires another step.
Adapt the journey to the user and requirement. Configure routing based on prior outcomes, age threshold, and applicable rules instead of sending every user through the same process.
Minimize personal data collection and retention. Return an age outcome, such as an age range or threshold result, and configure redaction of the underlying identity data after the decision.
Update methods and policies as requirements change. Manage routing, records, and user experiences in one platform instead of rebuilding each flow.
Talk to Persona’s age assurance team to review your user journey and plan an approach for New York and other jurisdictions.
The information provided is not intended to constitute legal advice; all information provided is for general informational purposes only and may not constitute the most up-to-date information. Any links to other third-party websites are only for the convenience of the reader.
FAQs
What is the New York SAFE for Kids Act?
Toggle description visibility
New York’s SAFE for Kids Act regulates addictive feeds and nighttime notifications for covered users. A covered platform generally cannot provide those features to a user under 18 unless it obtains verifiable parental consent. The law does not generally prohibit minors from accessing the platform or other available content.
When does the New York SAFE for Kids Act take effect?
Toggle description visibility
The final implementing rules take effect on January 25, 2027. If a platform later loses its exemption for the first time, it generally has 180 days to comply. If it loses the exemption again after later regaining it, the compliance period is generally 30 days.
Which platforms may be covered by the New York SAFE for Kids Act?
Toggle description visibility
A platform may be covered when users spend at least 20% of their total platform time on addictive feeds during a six-month period selected from the prior calendar year. A platform may be exempt if it has fewer than five million monthly active users or fewer than 20,000 monthly active users who are covered minors, unless its primary user base consists of minors.
Does the New York SAFE for Kids Act require platforms to offer parental consent?
Toggle description visibility
No. A platform does not have to let minors request parental consent for addictive feeds or nighttime notifications. If the platform offers that option, it must follow the rule’s notice, age assurance, parent-confirmation, withdrawal, and user-choice requirements.
Can a platform receive an age outcome without full identity information under the New York SAFE for Kids Act?
Toggle description visibility
Yes. Depending on the method and configuration, an age assurance provider can return an age status, age range, or threshold result without giving the platform the user’s full identity information. Confirm what each method collects, retains, and shares before implementation.
How can platforms reduce friction when implementing NY SAFE for Kids Act age assurance methods?
Toggle description visibility
Use a layered flow that starts with a lower-friction method, such as age inference or selfie age estimation, and moves to another method only when needed. A configurable flow can route users based on earlier results, location, and applicable requirements instead of requiring everyone to complete the same steps.
How does the NY SAFE for Kids Act differ from Australia’s Social Media Minimum Age law?
Toggle description visibility
Australia’s Social Media Minimum Age requirements generally prevent users under 16 from creating or maintaining accounts on covered social media platforms. On the other hand, New York’s SAFE for Kids Act does not impose a general account ban. Instead, it restricts addictive feeds and notifications between midnight and 6 a.m. Eastern for users under 18 unless the platform obtains verifiable parental consent.
New York also requires platforms to manage several states at once, including the user’s age status, parental consent, appeals, and eligibility for nighttime notifications. Platforms may need to change the feed or notification experience without blocking access to the rest of the service.
The age thresholds also differ. New York’s restricted-feature threshold is 18, while Australia’s minimum account age is 16. Read our guide to Australia’s Social Media Minimum Age requirements for more information.