New York Finalises Social Media Age Checks: What Changes in January

New York has finished writing the rules that will decide how social media works for everyone in the state, not only for children. The Attorney General's office released the final regulations for the SAFE for Kids Act on 28 July 2026. They are published in the State Register on 29 July, and the law takes effect 180 days after that, on 25 January 2027. From that date, a platform has to establish that a user is an adult before it may show that user an algorithmic feed.

What the law actually restricts

The Stop Addictive Feeds Exploitation for Kids Act was signed in June 2024, and the two years since have been spent on rulemaking. Proposed rules appeared in September 2025; these are the final ones.

The target is what the regulations call an addictive feed: an algorithmically personalised stream that recommends content based on data collected about the user, endlessly, largely from accounts the user never followed, out of chronological order. A platform falls under the law if it hosts user-generated content and users spend at least 20 percent of their time on such feeds.

For a user under 18, the default becomes a chronological feed of accounts they chose to follow. That is the whole change to the feed. The regulations are explicit that the minor keeps full access to the platform and to its content, and a platform may not lock a minor out for refusing the algorithmic version.

The second restriction concerns timing. Platforms may not send notifications to users under 18 between midnight and 6 a.m. without parental consent.

This is a different instrument from the outright minimum-age bans spreading elsewhere. Australia, France, Malaysia and others have gone the route of barring minors from holding accounts at all, and we track those in our running list of countries banning social media for children. New York does not ban anything. It removes the recommendation engine and the night-time notifications, and leaves the account intact.

Why this touches adults

This is the part that the shorter summaries circulating online tend to flatten into "New Yorkers will have to verify their age". The obligation is on the company. But an adult in New York who wants the recommendation feed to keep working will, in practice, have to pass an age check at some point before or shortly after January 2027.

How age assurance has to work

The rules do not mandate a single method, and this is where they differ from most state laws of the past two years.

• Choice of method: a platform may use an uploaded image of identification, or verify an email address or phone number and cross-check other signals that reflect age, or use another approach entirely, provided it meets the accuracy benchmarks in the regulations.
• No ID monopoly: a platform must offer at least one method that does not require a government-issued document. A person unwilling to hand a passport to a social network has to be given another route.
• Proven accuracy: methods must be tested annually, and results of that testing kept for a minimum of ten years.
• Data minimisation: only the minimum data needed to establish age may be used.
• Immediate disposal: anything collected to determine age or to obtain parental consent may not be used for any other purpose, and must be deleted or de-identified immediately after it has served that purpose.

The consent mechanism, and what it does not reveal

A minor who wants the restricted features has to ask for them affirmatively and accept that a parent will be notified. The parent then goes through age assurance themselves in order to give consent. Either side can withdraw that consent at any time.

One detail deserves attention because it is unusual in this class of legislation: the process is not designed to hand the parent a log of what the child searches for or is interested in. Consent covers the feature, not surveillance of the child's activity.

Enforcement

The Attorney General may bring actions against platforms that do not comply and seek civil penalties of up to 5,000 dollars per violation, alongside other remedies. Announcing the rules, Attorney General Letitia James said the act "leads the nation in keeping our children safe online". Governor Kathy Hochul framed it more bluntly, saying that children's mental health "isn't for sale".

The privacy tension nobody has resolved

New York's drafters clearly tried to address the standard objection to age verification, and the result is more careful than most: no forced government ID, mandatory data deletion, an explicit accuracy standard, and no lockout for minors who decline. Compared with the laws that simply require an ID upload, this is a meaningful improvement.

The underlying tension remains, though, and no drafting removes it. To verify that someone is over 18, a platform must collect something that identifies them, at least momentarily. A rule that the data be deleted immediately is a promise about behaviour, and enforcement of it depends on audits after the fact rather than on architecture that makes retention impossible. Critics of the act have argued since 2024 that requirements of this kind raise First Amendment questions and push platforms toward identity systems by default. Comparable laws in other states have been challenged in court repeatedly, and the industry position has consistently been that an age-verification layer is also, unavoidably, an identification layer.

What tends to happen next

There is now a pattern visible across jurisdictions that have switched on age checks. When Missouri's age verification requirement came into force, VPN demand in the state rose sharply within days, as it had in the United Kingdom and elsewhere before that. The same is likely in New York in January, and the reasons are mixed: some users are minors trying to get around a restriction, and many others are adults who simply do not want to submit identity data to a social network in order to keep using a product they have used for years.

It is worth being precise about what a VPN does here, because the marketing around these moments is usually careless. A VPN changes the apparent location of a connection, which can affect whether a regional rule is applied to a session at all. It does nothing to conceal an account that is already tied to a verified identity, and it is not a way to defeat a check that has already been passed. Any honest framing has to hold both halves of that.

Conclusion