New York puts a number on "addictive": the SAFE for Kids rules are final, the law starts in 2027
- The SAFE for Kids Act was enacted on 20 June 2024 as Chapter 120 of the Laws of 2024 (Senate bill S7694A, Assembly companion A8148A), adding Article 45, sections 1500 to 1508, to New York's General Business Law. It has never been operative. The Attorney General released the implementing rules, Part 700 of Title 13 of the NYCRR, on 28 July 2026; the Attorney General states they were to appear in the State Register on 29 July 2026, and the Act takes effect 180 days later, on 25 January 2027.
- The rule defines "addictive" as a share of user time, not as a clinical state. A platform is covered when 20 percent or more of the time its monthly active users spend on it is spent on personalised feeds, measured over any single six-month period the platform chooses from the prior calendar year. A monthly active user is someone who reaches a feed and stays at least one minute, counted either in the previous calendar month or as a one-month average across the previous quarter. Platforms with fewer than 5 million monthly active users, or fewer than 20,000 monthly active users who are known minors, are exempt unless their primary user base is minors.
- Age checking carries a written error budget. A false positive here means a minor classified as an adult, and the rule permits up to 0.1 percent at ages 0 to 7, 1 percent at 8 to 13, 2 percent at 14 to 15, 8 percent at age 16 and 15 percent at age 17. Detection of circumvention must reach at least 98 percent. Each method must be certified annually by an accredited third party against ISO/IEC 27566-1:2025 or IEEE 2089.1-2024 or an equivalent standard.
- What the document does not establish: it creates no diagnosis, no screening duty, no treatment funding and no insurance obligation. It gates two design features behind parental consent, the personalised feed and notifications between 12 AM and 6 AM Eastern. Section 1508 also bars the Attorney General from bringing an enforcement action until no earlier than 180 days after the article takes effect, with civil penalties then capped at 5,000 dollars per violation.
Parents and patients will soon tell you that New York has banned addictive feeds for teenagers. That is not what happened, and the distance between the headline and the instrument is clinically useful. On 28 July 2026 the state Attorney General finally published the rules that give a two-year-old statute operative content, and nothing in it binds anyone before 25 January 2027.
What the rule actually regulates
The legislative history matters because it is routinely compressed. The bill passed the Senate on 6 June 2024 and the Assembly on 7 June 2024, and Governor Hochul signed it on 20 June 2024 as Chapter 120. But the statute delegated its own operative content: section 1501 required the Attorney General to identify by regulation which age determination methods are commercially reasonable and technically feasible, and section 1505 granted the rulemaking authority. Until those rules existed there was, in practice, nothing for a platform to comply with. The Office of the Attorney General issued an advance notice of proposed rulemaking on 1 August 2024 with a 60-day comment period, released proposed rules on 15 September 2025, and released the final rules on 28 July 2026.
The substance is narrow and precise. It is unlawful for a covered operator to serve a personalised feed to a New York user, or to send notifications about such a feed between 12 AM and 6 AM Eastern, unless the operator has determined through a compliant method that the user is not a minor, or has obtained verifiable parental consent. Consent must be freely granted, specific and informed: refusing must be at least as easy as granting, feed and notifications must be grantable separately, and the notice must be available in at least the 12 most commonly spoken languages in the state. Either the parent or the minor may withdraw it at any time.
Then come the numbers a regulator was willing to write down. Twenty percent of monthly-active-user time on personalised feeds triggers coverage. One minute on the platform, with feed access, makes someone a monthly active user, counted in the previous calendar month or as a one-month average across the previous quarter. Data collected for age assurance or parental consent may not be reused for anything else and must be deleted or de-identified immediately after its intended use, with two carve-outs pulling the other way: specified age-assurance records must be kept for no less than 5 years, and certification test results for at least 10. An operator that verifies age by government-issued ID must also offer at least one method that does not require one, unless it already holds such ID under other law or uses a zero-knowledge proof. The Attorney General's own release states that algorithmic feeds and nighttime notifications are "tied to depression, anxiety, eating and sleep disorders" in young people; that is the regulator's rationale, not a finding contained in the rule.
For your practice
Between now and 25 January 2027 nothing changes for a New York family, and it is worth saying so plainly. When a parent asks whether the new law will restrict a 15-year-old's feed, the accurate answer has three parts: the obligation begins in 2027, it reaches only large platforms, and it operates by consent rather than by prohibition. Enforcement then lags a further 180 days by the statute's own terms.
The consent architecture is the part families will misread, and misreading it produces avoidable conflict. Refusing consent does not remove a child from the platform. The minor keeps access to the service, its content and its search; what is gated is the personalised ordering of the feed and the overnight notification window. The two levers are separable. So the useful conversation in the room is not "should we cut it off" but "which of these two, and who is holding it, and what happens when the child asks for it back".
Take the night window as the concrete item. The hours the statute chose, midnight to 6 AM, point at displaced sleep, and the sponsor's memo makes that argument explicitly. Read that as the legislature's reasoning and mine, not as a finding: a sponsor memo is not evidence, and the rule itself contains none. You do not need a statute to act on it, and you can act on it now, in any jurisdiction. And note what the rule pointedly does not contain for the minority who genuinely meet functional-impairment criteria: no assessment pathway, no referral route, no funded treatment. A design regulation is not a health service, and a family that has crossed into real impairment will not be helped by waiting for January 2027.
The state did not define addiction; it defined a threshold, 20 percent of user time on a personalised feed.
This is a document, not an outcome: no provision of Part 700 has been evaluated for any effect on adolescent mental health, and the causal claims in the Attorney General's press release are the regulator's rationale rather than findings of the rule. No challenge to these rules had been reported as of early August 2026, and comparable state statutes elsewhere have drawn First Amendment challenges, so the January 2027 date is not guaranteed. Figures here are taken from the rule text published on the Attorney General's website; the State Register version is the controlling text.