New York Adopts Legislation to Protect Kids’ Privacy

The New York State Legislature has passed two significant laws designed to protect children’s and teen’s privacy: the Stop Addictive Feeds Exploitation (SAFE) for Kids Act and the Child Data Protection Act. Signed by Governor Kathy Hochul on June 20th, the laws will considerably impact how businesses engage with New York children and teens online.

The SAFE for Kids Act is a first-of-its-kind law in New York aimed at regulating algorithms used by social media companies when they are aimed at children and teens. The Child Data Protection Act is the latest state law limiting the personal information of children and teens that media companies can collect, sell and use for targeted advertising purposes.

The SAFE for Kids Act

The SAFE for Kids Act regulates “addictive feeds” operated by social media companies. Under the law, an “addictive feed” is defined as “a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user’s device,” unless certain conditions are met. In simpler terms, addictive feeds are those that are algorithmic in nature and that take user or user device data into account.

The SAFE for Kids Act will prohibit social media companies from showing such algorithmic “addictive feeds” to individuals under 18 years old. Specifically, the law disallows social media companies from doing so unless:

1. the company has used “commercially reasonable and technically feasible methods to determine that” a user is not a minor and
2. the company has “obtained verifiable parental consent to provide an addictive feed” to the minor.

The law further prohibits social media companies from sending overnight push notifications (those sent between midnight and 6 a.m.) for addictive feeds to minors, unless the social media company receives verified parental consent.

This new social media law applies to “conduct that occurs in whole or in part in New York.” Conduct takes place outside of New York if “the addictive social media platform is accessed by a user who is physically located outside of New York.” Beginning 180 days from the effective date, the SAFE for Kids Act will allow the New York Attorney General to bring injunctive actions and seek penalties of up to $5,000 per violation. The law also allows the Attorney General to establish acceptable age verification and parental consent methods via a rulemaking process and requires the Attorney General to establish a website to receive complaints — but it does not provide a private right of action for individuals to bring claims.

Similar initiatives in other states have not survived legal challenges, so it remains to be seen whether the SAFE for Kids Act will survive.

The Child Data Protection Act

The Child Data Protection Act regulates targeted advertising to children and teens, and more broadly regulates data collection from children and teens.

Specifically, the law prohibits online sites from collecting, using, sharing or selling personal information of minors 12 and under, unless such processing is permitted under the Children’s Online Privacy Protection Act (COPPA) and its implementing regulations. For minors who are 13 and older, the law prohibits online sites from collecting, using, sharing or selling personal information of those minors unless the sites receive informed consent from the minor or the processing is strictly necessary for the site’s purposes.

The law further limits the use of a minor’s personal information for the purpose of delivering targeted advertising. Like the SAFE for Kids Act, the Child Data Protection Act authorizes the New York Attorney General to seek injunctive relief and civil penalties of up to $5,000 per violation but does not have a private right of action for individuals to bring claims.

The Bottom Line

• New York joins the growing list of states to pass laws that protect children and teens under 18 years of age by regulating the collection, sale, and usage of their personal information and addressing the use of algorithms that keep users hooked on social media services.
• The SAFE for Kids Act prohibits social media companies from showing addictive, algorithmic feeds and overnight push notifications to minors.
• The Child Data Protection Act regulates how minors’ personal information is treated by businesses online.