New York Children's Privacy Laws (2026)

App Store / Device Age-Assurance Act (operating system / app store age verification) · S8102-B (2025-2026 session, Sen. Gounardes); A8893

Pending: A bill was introduced this cycle but is not yet law. · App store · binds app stores, operators, developers, platforms

Ages: under 18

Requires: Would require operating system providers / app stores / device manufacturers of internet-enabled devices to conduct commercially reasonable and technically feasible age assurance for users under 18 at the point of device activation/account creation, and to communicate a user's age category to applications. Not yet law.

Litigation: None. The bill has not been enacted, so there is no enforcement to challenge.

Entry last reviewed 2026-07-18

Stop Addictive Feeds Exploitation (SAFE) For Kids Act · S7694A / A8148A (Chapter 120 of 2024); GBL Article 45

Enacted, not yet effective: Signed into law; its effective date is still in the future. · Social media · the rulemaking that gates this Act is DONE, and the clock has started. The Attorney General adopted the implementing rules (addition of Part 700 to Title 13 NYCRR) by Notice of Adoption LAW-39-25-00001-A, Filing No. 688, published in the New York State Register of 2026-07-29 (Vol. XLVIII, Issue 30). This closes the 2026-10-01 lapse risk the entry previously flagged. Two official instruments then disagree by 15 days on when the Act takes effect. 13 NYCRR 700.11 sets it at the 180th day after publication in the State Register, which is 2027-01-25, and that is the date the Attorney General states publicly. The Register's own notice records a Filing Date of 2026-07-14 and an effective date of '180 days after filing', which computes to 2027-01-10. This entry publishes 2027-01-25 because the rule text and the Attorney General agree on it, but a conservative compliance plan should assume 2027-01-10 · binds operators, platforms

Ages: under 18

Requires: Bars covered social media operators from providing an 'addictive feed' (algorithmically personalized feed) to a minor (under 18) without verifiable parental consent, and restricts overnight (12am-6am) notifications to minors without consent. Requires commercially reasonable age determination/assurance. Enforced by the NY Attorney General.

Litigation: No suit filed against the NY SAFE for Kids Act. NetChoice and EFF have publicly criticized the law on First Amendment/privacy grounds but have not sued. Not enjoined.

Entry last reviewed 2026-07-30

New York Child Data Protection Act · S7695B (Ch. 121 of 2024)

In force: Effective and enforceable today. · Design code · effective 2025-06-20 · binds operators

Ages: Minors under 18 (under 13 governed by COPPA; teens 13-17 protected directly)

Requires: Operators of online services, apps, and connected devices may not process the personal data of a user they know or should know is a minor under 18 unless processing is strictly necessary for an enumerated purpose or the minor (or, for under-13s, the parent per COPPA) gives informed, separately-presented, freely-revocable opt-in consent. Targeted advertising and behavioral profiling of minors require consent and the sale/purchase of minors' personal data is prohibited; for users under 13 data may only be processed consistent with COPPA.

Entry last reviewed 2026-07-18

Safe by Design Act (NY) · S9008C/A10008C (TED budget bill), Chapter 58 of the Laws of 2026; GBL Article 45-B (originally introduced as the standalone Stop Online Predators Act, S4609/A6549)

Enacted, not yet effective: Signed into law; its effective date is still in the future. · Social media · effective 2027-01-01 · binds operators, platforms

Ages: Minors under 18, with heightened protections (parental approval required for new connections) for under-13s

Requires: Requires covered social media and gaming platforms to set the highest-privacy default settings for known minor accounts. Adults who are not existing connections cannot privately message minors, view their full profiles, or tag them in content by default; location sharing defaults to off, and under-13 users need parental approval before adding new connections. It also requires AI companion/chatbot features aimed at kids to be off by default and gives parents tools to see and limit a minor's in-platform financial transactions. Enforced by the NY Attorney General.

Litigation: No suit filed. Industry groups (e.g., NY City Bar Association memo opposing the 'Safe Design Framework') submitted opposition during the legislative process, but no litigation has been identified against the enacted budget provision.

Entry last reviewed 2026-07-18

Artificial Intelligence Companion Models law (GBL Article 47) · Part U of the FY2026 budget (S3008-C/A3008-C), Chapter 58 of 2025; GBL Secs. 1700-1702

In force: Effective and enforceable today. · AI companion · effective 2025-11-05 · binds operators

Ages: All users; no minor-specific tier (the general duties still bind a kids' companion product)

Requires: Operators of an 'AI companion' (a system designed to simulate a sustained human-like relationship via retained cross-session personalization, unprompted emotion-based questions, and ongoing personal dialogue; all three prongs required) may not operate without a protocol for detecting suicidal ideation or self-harm and referring users to crisis services such as the 988 hotline (Sec. 1701), and must give clear notice that the companion is not human at the start of each interaction and at least every three hours during continuing interactions (Sec. 1702). Customer-service bots, efficiency and research tools, and internal business systems are excluded (Sec. 1700(4)(c)).

Litigation: No lawsuit identified. In effect since 2025-11-05; the Governor's office formally notified operators the safeguards are in force.

Entry last reviewed 2026-07-18

Unsafe AI companion features prohibition (S 9051-B / A 10379-C) · S 9051-B, substituted for A 10379-C; would add GBL Article 48, §§ 1800-1805. The print carries no short title

Pending: A bill was introduced this cycle but is not yet law. · AI companion · proposed effective 2027-01-01 · binds operators

Ages: Minors under 18; the prohibition applies unless age assurance shows the user is not a minor

Requires: Would make it unlawful for an operator to provide unsafe AI companion features to a New York user unless a permissible age assurance method has determined the user is not a minor. Twelve enumerated unsafe features include human impersonation, simulated personal relationships, flattery and sycophancy, unprompted emotional probing, reuse of personal information older than twelve hours or from prior sessions, promotion of suicide, self-harm or disordered eating, secrecy encouragement, engagement optimization that overrides safety guardrails, and sexually explicit content. Age assurance must offer more than one method, including one that avoids government ID or preserves anonymity, and age data must be deleted after the check. Attorney General enforcement with civil penalties up to $25,000 per violation; no private right of action, and liability waivers are void.

Litigation: None; not enacted. Passed the Senate 2026-06-04 and the Assembly, substituted for A 10379-C, on 2026-06-05; returned to the Senate and not yet delivered to the Governor. If signed, takes effect 2027-01-01.

Entry last reviewed 2026-07-25