New York Children’s Privacy Laws (2026)

S7694A / A8148A (Chapter 120 of 2024); GBL Article 45

Enacted, not yet effective · Social media · effective 2027-01-25 · binds operators, platforms

Ages: under 18

Requires: Bars covered social media operators from providing an 'addictive feed' (algorithmically personalized feed) to a minor (under 18) without verifiable parental consent, and restricts overnight (12am-6am) notifications to minors without consent. Requires commercially reasonable age determination/assurance. Enforced by the NY Attorney General.

Timing: effective 2027-01-25. The Attorney General adopted the implementing rules (addition of Part 700 to Title 13 NYCRR) by Notice of Adoption LAW-39-25-00001-A, Filing No. 688, filed 2026-07-14 and published in the New York State Register of 2026-07-29 (Vol. XLVIII, Issue 30). 13 NYCRR 700.11 sets the rules' effect at the 180th day after that publication, the Attorney General's 2026-07-28 release gives the same day, and the codified article, revised 2026-07-31, carries 'NB Effective January 25, 2027' in place of its earlier rules-gated note. Chapter 120 of 2024, Sec. 5, directs the Attorney General to notify the Legislative Bill Drafting Commission when the rules are enacted so the commission can keep its effective-date database current, and the codified note is that commission's record of the date. The Register notice's own form line reads 'Effective Date: 180 days after filing', which would compute to 2027-01-10 for the rules; no official instrument gives that date for the Act, and no court or agency ruling has construed the 15-day discrepancy, so 2027-01-25 is the best-supported date rather than an adjudicated one. Enforcement lags the effective date: under Sec. 1508(1) the Attorney General may bring an action only 'No earlier than one hundred eighty days after the effective date of this article', which counts to 2027-07-24 from 2027-01-25; no instrument states that enforcement date

Litigation: No challenge to the SAFE for Kids Act identified in RECAP searches of the New York federal courts and the Second Circuit or on NetChoice's and CCIA's litigation pages, which carry no New York case against Article 45. NetChoice and EFF have publicly criticized the law on First Amendment/privacy grounds but have not sued. Not enjoined.

Entry last reviewed 2026-10-01

S4505 / A5346, Chapter 689 of the Laws of 2025, rewritten before taking effect by the chapter amendment S8827 / A9446, Chapter 85 of the Laws of 2026; GBL Secs. 1520-1526. Neither print carries a short title, so the codified article heading is used

Enacted, not yet effective · Social media · effective 2027-01-01 · binds platforms, operators

Ages: All users by default; the only age line is the Sec. 1525(5) exemption, under which a covered operator is not required to show the label to a user it has reasonably determined is over 17, so the duty applies by default to every user the operator has not reasonably determined to be over 17, which is meant to include every minor, though a minor the operator reasonably misjudged falls within the textual safe harbor (the CA AB 56 shape; appliesToUnder 18 is the tracker's indexing convention for that shape)

Requires: From 2027-01-01, a covered operator (anyone operating a social media platform under GBL 1100(5) that offers an addictive feed, autoplay or infinite scroll as a significant part of its service) may not provide any of those features to a user in New York unless it shows the statute's fixed label: 'The Surgeon General has warned that while social media may have benefits for some young users, excessive use may be associated with significant mental health harms.' Each calendar day the label must appear at the user's first access (at least 25 percent of the screen for at least 10 seconds, no bypass or click-through), and again after three hours of cumulative active use and at least hourly after that (at least 75 percent of the screen for at least 30 seconds, likewise unskippable). A label placed only in the terms of service, obscured, or paired with any other design feature or mechanism that 'intentionally serves to inhibit or subvert the purpose of this article' (1522(3)(c)) is prohibited, and the operator may not withhold, degrade, lower the quality or increase the price of anything because it showed the label, except as necessary to comply with the article or its rules. The duty is on for every user by default: an operator 'shall not be required' to show the label to a user it 'has reasonably determined' is over 17 (1525(5)), so a platform that makes no age determination must warn adults too. The label is no defense to other claims, and the article yields to COPPA and the SAFE for Kids Act. Sec. 1526 gives enforcement to the Attorney General alone: injunction, restitution, disgorgement, damages and civil penalties of up to $5,000 per violation; the article creates no private right of action.

Timing: effective 2027-01-01, a fixed date with no rulemaking gate. Chapter 689 of 2025 was to take effect on the 180th day after the Attorney General promulgated rules and never took effect under that clause; Chapter 85 of 2026 (signed 2026-02-13), Sec. 5, struck that trigger before it ran and substituted January 1, 2027, and the codified article carries 'NB Effective January 1, 2027'. Sec. 1524 lets the Attorney General issue rules but nothing conditions the duty on them

Litigation: No challenge identified in RECAP searches of the New York federal courts and the Second Circuit or on NetChoice's and CCIA's litigation pages; the duty is not operative before 2027-01-01.

Entry last reviewed 2026-10-01

S7695B / A8149A (Chapter 121 of 2024); GBL Article 39-FF

In force · Design code · effective 2025-06-20 · binds operators

Ages: Minors under 18 (under 13 governed by COPPA; teens 13-17 protected directly)

Requires: Operators of websites, online services, apps and connected devices may not process (or let a processor process, or a third-party operator collect) the personal data of a 'covered user': a New York user the operator actually knows to be under 18, or any user of a service primarily directed to minors, and an operator must also treat a user as covered when the user's device signals minor status (Sec. 899-ii). For a covered user 12 or younger, processing is allowed only as COPPA permits; for one 13 or older, only where strictly necessary for a listed purpose (such as providing the requested service, internal operations that exclude marketing, advertising and research and development, security, or legal compliance) or with informed consent that is requested separately, makes refusal the most prominent option, is freely revocable, and is not re-requested for the following calendar year after a refusal. Operators may not withhold, degrade or reprice a service for lack of consent or (subject to Sec. 899-jj) buy or sell a covered user's personal data, must delete data they may not keep and notify the third-party operators they shared it with within 30 days of learning a user is covered, and face Attorney General enforcement with civil penalties of up to $5,000 per violation.

Litigation: No challenge to Article 39-FF identified in RECAP searches of the New York federal courts and the Second Circuit. In force since 2025-06-20. The Attorney General's 2025-05-19 implementation guidance says the office will exercise discretion in pursuing enforcement of the device age-flag duty (Sec. 899-ii(1)) until its rules on that duty are finalized and in effect, 'so long as operators otherwise exhibit good-faith efforts to comply', and will take operators' good-faith compliance efforts into account generally until its rules are proposed and finalized; no Child Data Protection Act rule proposal is pending in the State Register.

Entry last reviewed 2026-10-01

S9008C/A10008C (TED budget bill), Chapter 58 of the Laws of 2026; GBL Article 45-B (originally introduced as the standalone Stop Online Predators Act, S4609/A6549)

Enacted, not yet effective · Social media · effective 2027-01-01 · binds operators, platforms

Ages: Minors under 18, with heightened protections (parental approval required for new connections) for under-13s

AI chatbot access for minors: Off by default for minors (enacted, applies from 2027-01-01).

Requires: Applies to a 'covered platform': a public or semi-public website or app used by minors in New York that lets users build a public or semi-public profile and message each other privately and also either lets users post media that others can view and respond to, or lets users create or play online games with in-game purchases for money or exchanges between money and digital currency. Before offering private messaging, full-profile viewing, responding to or downloading a user's media, tagging, location viewing, an integrated AI companion or money-based game purchases, the operator must run age assurance that does not rely on self-declared age; for users it determines to be under 18, the defaults must stop adults who are not already connected from messaging them, viewing their full profile, responding to or downloading their media, tagging them or seeing their location, their profiles may not be suggested to unconnected adults (contact syncing excepted), any integrated AI companion (an Article 47 AI companion offered as a platform feature, other than a game character confined to the game's fiction) must be off by default, and a parent may override each default separately. Under-13s need parental consent before connecting with another account, parents of minors on money-based game platforms must get a monthly spending-limit control (or the option to opt out of setting one) and a full transaction history, design features that subvert these choices are prohibited, and the Attorney General enforces with civil penalties of up to $5,000 per violation.

Litigation: No challenge identified in RECAP searches of the New York federal courts and the Second Circuit; the article is not operative before 2027-01-01. During the budget process two New York City Bar Association committees (Civil Rights; LGBTQ+ Rights) issued a memo urging the Legislature and the Governor to oppose Part Y on First Amendment and privacy grounds.

Entry last reviewed 2026-10-01

Part U of the FY2026 budget (S3008-C/A3008-C), Chapter 58 of 2025; GBL Secs. 1700-1704

In force · AI companion · effective 2025-11-05 · binds operators

Ages: All users; no minor-specific tier (the general duties still bind a kids' companion product)

AI chatbot access for minors: Safeguards only (in force).

Requires: Operators of an 'AI companion' (a system designed to simulate a sustained human-like relationship via retained cross-session personalization, unprompted emotion-based questions, and ongoing personal dialogue; all three prongs required) may not operate one without a protocol that takes reasonable efforts to detect and address users' expressions of suicidal ideation or self-harm, including referring them to crisis services such as the 988 hotline (Sec. 1701), and must clearly and conspicuously tell users they are not communicating with a human at the beginning of an interaction (that opening notice need not be given more than once a day) and at least every three hours during continuing interactions (Sec. 1702). Customer-service bots, efficiency and research tools, and internal business systems are excluded (Sec. 1700(4)(c)). The Attorney General enforces by injunction and civil penalties of up to $15,000 per day for a violation of Sec. 1701 or 1702, paid into the state suicide prevention fund (Sec. 1703).

Litigation: No lawsuit identified. In effect since 2025-11-05; the Governor's office formally notified operators the safeguards are in force.

Entry last reviewed 2026-10-01

S 9051-B, substituted for A 10379-C; would add GBL Article 48, §§ 1800-1805. The print carries no short title

Pending · AI companion · proposed effective 2027-01-01 · binds operators

Ages: Minors under 18; the prohibition applies unless age assurance shows the user is not a minor

AI chatbot access for minors: Blocks features for minors (proposed in a pending bill, not law).

Requires: Would make it unlawful for an operator to provide unsafe AI companion features to a New York user unless a permissible age assurance method has determined the user is not a minor. Twelve enumerated unsafe features include human impersonation, simulated personal relationships, flattery and sycophancy, unprompted emotional probing, reuse of personal information older than twelve hours or from prior sessions, promotion of suicide, self-harm or disordered eating, secrecy encouragement, engagement optimization that overrides safety guardrails, and sexually explicit content. Age assurance must offer more than one method, including one that avoids government ID or preserves anonymity, and age data must be deleted after the check. Attorney General enforcement with civil penalties up to $25,000 per violation; no private right of action, and liability waivers are void.

Litigation: None; not enacted. Passed the Senate 2026-06-04 and the Assembly, substituted for A 10379-C, on 2026-06-05. The official action list ends with that day's return to the Senate and records no delivery to the Governor. Senate-originated bills are commonly held by the Senate at the sponsor's request under Senate Rule IX, sec. 9, and delivered late in the year. Once delivered, the Governor has ten days, Sundays excepted, to sign or return the bill, or thirty days after the Legislature's final adjournment, where inaction is a pocket veto (N.Y. Const. art. IV, sec. 7); a late-December delivery can therefore be decided as late as January 2027. If signed, takes effect 2027-01-01.

Entry last reviewed 2026-10-01

S 9408-A, substituted for A 11144-B; would add GBL Article 48, Secs. 1800-1802. The print carries no short title

Pending · AI companion · binds operators

Ages: Children 12 or younger: the ban turns on the product being a children's toy under 15 U.S.C. 2057c(g) (a product designed or intended for a child 12 or younger to use in play), not on a user-age test

AI chatbot access for minors: Bans chatbot toys (proposed in a pending bill, not law).

Requires: Would make it unlawful for anyone to manufacture, exchange, hold for sale, distribute or sell in New York a 'chatbot toy': an AI companion, as defined in GBL 1700(4) (the Article 47 definition), embedded in or integrated with a children's toy. The enforcement section reaches an operator (anyone who operates or provides an AI companion in a children's toy): the Attorney General could seek an injunction and civil penalties of up to $15,000 per day for each violation, with no proof of injury required for a violation of the ban. The ban would expire five years after taking effect.

Timing: if signed, would take effect on the ninetieth day after becoming law and expire five years after that effective date

Litigation: None; not enacted. Passed the Senate 2026-06-01 (57-3) and the Assembly, substituted for A 11144-B, on 2026-06-02. The official action list ends with that day's return to the Senate and records no delivery to the Governor. S 9051-B, also pending, would add a different GBL Article 48 numbered from Sec. 1800, so the two would collide if both became law.

Entry last reviewed 2026-10-01

A 3411-B, substituted for S 934-A; would add GBL Sec. 399-zzzzzz. The print carries no short title

Pending · AI companion · binds operators

Ages: All users; no minor-specific tier (the notice duty would still bind a kids' AI chatbot product)

AI chatbot access for minors: Safeguards only (proposed in a pending bill, not law).

Requires: Would require the owner, licensee or operator of a generative AI system (a self-supervised AI model that generates text, images, audio, video or other content, so chatbots and image generators alike) to clearly and conspicuously display a notice on the system's user interface that its outputs may be inaccurate. Civil penalty of up to $1,000 per violation, with each user not given the notice counted as a separate violation.

Timing: if signed, would take effect on the ninetieth day after becoming law

Litigation: None; not enacted. Passed the Assembly 2026-01-28 and the Senate (58-2), substituted for S 934-A, on 2026-03-09. The official action list ends with that day's return to the Assembly and records no delivery to the Governor.

Entry last reviewed 2026-10-01