On June 20, 2024, New York Governor Kathy Hochul signed two bills into law to regulate social media algorithms for minors. The SAFE Act prohibits social media companies from generating “addictive feeds” — feeds generated by algorithms that collect user information — to individuals under 18 years of age. The CDPA prohibits online sites from collecting, using, sharing, or selling minors’ data without consent. Both laws authorize the Office of the New York State Attorney General (OAG) to enforce them and seek penalties. The SAFE For Kids Act goes into effect one hundred eighty (180) days after the OAG promulgates rules and regulations necessary for compliance with the law. The CDPA goes into effect on June 20, 2025.
Definitions under SAFE For Kids Act and Child Data Protection Act
Addictive Feed
A website, online, or mobile application in which media is recommended and selected for display to a user based on information associated with the user or their device. This definition excludes media that is not associated with a user’s device, technical information concerning a user’s device, any content that a user subscribes to or affirmatively blocks, direct communications, or any media shown in response to a user’s search inquiry.
Addictive Social Media Platform
A website or application that provides users with an addictive feed as a significant part of its services.
Covered Minor
A user of a website or application in New York State where the operator of the website or application has actual knowledge that the user is a minor.
Covered User
A user of a website or application not acting as an operator, agent, or affiliate of the operator.
Covered Operator
Any person, business, or other legal entity who operates or provides an addictive social media platform.
SAFE For Kids Act: Key provisions and requirements
The SAFE For Kids Act is only applicable to social media platforms whose feeds comprise user-generated content, along with other platform-recommended material, based on data collected from users, such as Facebook, Instagram, and TikTok. It prohibits a covered operator from providing an addictive feed to a covered user unless:
- The covered operator has used reasonable and technically feasible methods to determine that the covered user is not a covered minor; or
- The covered operator has obtained parental consent to provide an addictive feed to a covered minor.
The SAFE For Kids Act also prohibits covered operators of an addictive social media platform from sending notifications related to an addictive feed to a covered minor during the hours of 12:00 a.m. (midnight) and 6:00 a.m. Eastern time, unless an operator has obtained parental consent. Instead of addictive feeds, minors will see a chronological feed of content only from those individuals whom they already follow or content that is generally popular. Minors will also be able to run searches related to specific topics of interest.
The SAFE For Kids Act vests the OAG with the authority to promulgate rules and regulation as needed for enforcement and calls on the OAG to create a website to receive complaints. The law also allows the OAG to seek injunctive relief, damages, and civil penalties up to $5,000 per violation.
With the passage of the SAFE For Kids Act, New York legislators hope to protect minors’ mental health from addictive feeds, in addition to improving sleep habits during formative years for minors.
CDPA: Key provisions and requirements
Recognizing the minimal online privacy protections in existence for minors and the susceptibility of minors to having their location and other personal data tracked and shared with third parties, the CDPA was enacted to regulate advertising to and data collection from minors.
The CDPA is applicable to a broader swath of companies, known as operators, including those that operate or provide a website on the internet, online service, online application, mobile application, or connected device, and that:
- collect or maintain, either directly or indirectly, personal data from or about website, service, application, or connected device users;
- integrate with another website, service, application, or connected device and directly collect users’ personal data;
- allow other individuals to collect personal data directly from website, service, application, or connected device users; or
- allow website, service, application, or connected device users to publicly disclose personal data. The CDPA also applies when a company is collecting personal information in whole or in part within New York State.
Specifically, the CDPA regulates advertising and data collection with respect to minors:
- For children age 12 and under, the CDPA prohibits covered operators from processing minors’ data.
- For teens age 13 and older, the CDPA prohibits covered operators from processing minors’ data unless consent is obtained or processing is strictly necessary for the operators’ business, its functionality, to prevent fraud, or to comply with laws or inquiries.
- The CDPA prohibits operators from processing, or allowing their third-party processors to process, a minor’s personal data unless it is strictly necessary for a permissible purposes as defined in the law. These include, but are not limited to:
- Providing or maintaining a specific product or service requested by the covered user;
- Conducting the operator’s internal business operations, such internal business operations — provided, however, that such internal operations shall not include any activities related to marketing, advertising, research and development; providing products or services to third parties; or prompting covered users to use the website, online service, online application, mobile application, or connected device when it is not in use
- Complying with federal, state, or local laws, rules, or regulations; or
- Detecting, responding to, or preventing security incidents or threats.
Like the SAFE For Kids Act, the OAG may seek injunctive relief, damages, and civil penalties of up to $5,000 per violation.
Impact of enactment
New York is the latest to join a group of states, including Arkansas, Florida, Maryland, and Utah, that have attempted to pass laws aiming to decrease the availability of social media to minors and restrict social media companies’ ability to gather and use minors’ data. The tech industry has persistently raised First Amendment challenges to these laws. As a result of these laws, social media companies and other companies with an online presence in New York will need to adjust their data-gathering processes, algorithms, and notifications pertaining to minors to avoid facing liability.
For more information on the content of this alert, please contact your Nixon Peabody attorney or the authors of this alert.