What's in the rules

Algorithmically personalized feeds, or addictive feeds, recommend or personalize content for users in an endless stream based on data that the platform gathers about the user. They are designed to encourage a user to continue to use and return to a platform. Content displayed in addictive feeds is often from accounts that a user has not selected, does not follow, and is often displayed out of chronological order.

Addictive feeds are known to drive unhealthy levels of social media use in minors that can affect their mental health. Research shows that children as young as 10 to 14 years old experience addictive use of social media, and the more time children spend on social media, the more likely they are to experience negative mental health outcomes such as depression, anxiety, and eating and sleep disorders.

The SAFE for Kids Act addresses these mental health concerns for children by requiring social media companies to restrict addictive feeds for users under 18. Instead of the default algorithmically personalized feeds designed to keep young people on the platform, users under 18 will only be shown content from other accounts they follow or otherwise select in a set sequence, such as chronological order, unless they get parental consent for an addictive feed. Users cannot be cut off from the platform simply because they either do not want or do not have parental consent for an addictive feed. Instead, all users will still be able to access all the same content they can access now. The law also prohibits social media platforms from sending notifications to users under 18 from 12 a.m. to 6 a.m. without parental consent.

Signed into law by Hochul in June 2024, the SAFE for Kids Act authorized the Office of the Attorney General (OAG) to promulgate rules on how companies should comply with the law before the statute goes into effect, including rules that set industry standards for determining a user’s age and securing parental consent. The OAG issued an advanced notice of proposed rulemaking on August 1, 2024, and provided the public with a 60-day period to submit comments. The proposed rules were made public for review on September 15, 2025. The OAG incorporated public input, industry research, and its significant experience to inform the proposed and final rules.

Age Assurance

• Under the law and regulations, social media companies must determine that a given user is an adult before providing them with algorithmic feeds and/or nighttime notifications. Companies may confirm a user’s age using any methods that meet accuracy benchmarks and protect users’ data as set forth in the regulations. Companies can use options such as:
  • Requesting an uploaded image or video; or
  • Verifying a user’s email address or phone number to cross-check other information that reflects a user’s age.
• Social media companies must offer at least one alternative method for age assurance besides providing a government-issued ID.
• Any information used to determine age or obtain parental consent must not be used for any other purpose and must be deleted or de-identified immediately after its intended use. Social media companies must use only the minimum amount of data necessary to confirm a user’s age.
• Minor users must have an option to update their age status on the platform when they turn 18.
• Social media companies must choose an age assurance method with a high accuracy rate, conduct annual testing, and retain the results of the testing for a minimum of 5 years.

Parental Consent

• Minors must affirmatively seek access to prohibited features and must consent to their parent being notified. Any parent who wants to grant consent must go through age assurance.
• The platform may not block a minor user from generally accessing the platform or its content through, for example, searches, simply because they or their parent has refused to consent.
• Parents and minors must also have the option to withdraw their consent at any time.

The SAFE for Kids Act and rules apply to “Addictive Online Platforms,” defined as platforms that display user-generated content and have users who spend at least 20 percent of their time on the platform’s addictive feeds measured over a six-month period.

The full final rules can be found on OAG’s website. The final rules will be published in the State Register on July 29, 2026. The SAFE for Kids Act goes into effect 180 days later, on January 25, 2027.

For companies that violate the SAFE for Kids Act, the law authorizes OAG to bring an action to stop violations as well as to seek civil penalties of up to $5,000 per violation, among other remedies.