New York's SAFE for Kids Act Gets Teeth: Age Verification Coming to Algorithmic Feeds

New York's Attorney General has finalized rules implementing the SAFE for Kids Act, requiring social media platforms to verify users' ages before granting access to algorithmic feeds and late-night notifications. The rules set concrete compliance standards for platforms like Instagram and TikTok, with enforcement beginning later this year. Here's what the law actually requires — and what it means for the broader tech industry.

New York is about to become the most consequential state-level battleground for social media regulation in the US. Attorney General Letitia James has released finalized implementation rules for the SAFE for Kids Act, signed into law by Governor Kathy Hochul in June 2024 — and the specifics reveal a more aggressive framework than many in the industry anticipated.

What the Law Actually Requires

The core mechanism is straightforward but technically demanding: social media platforms must verify the age of users before allowing access to two specific features:

Algorithmically curated feeds (the ranked, personalized content experience most users see by default on Instagram, TikTok, and similar platforms)
Notifications sent between midnight and 6 AM

For users who are minors, platforms must obtain verifiable parental consent before those features can be unlocked. Adults who don't want to verify their age can still use these platforms — but only in a chronological, non-personalized feed mode.

The finalized rules go further than the original statute by laying out specific technical and procedural standards for age assurance. Platforms can't simply ask users to self-report their birthdate. The rules require methods robust enough to meaningfully distinguish minors from adults, though the AG's office has left some flexibility in which verification technologies qualify.

Why This Is a Big Deal for Platforms

The practical burden falls squarely on the largest social media companies. Meta (Instagram, Facebook), ByteDance (TikTok), Snap, and YouTube all operate algorithmic feeds that are central to their engagement and advertising models. Stripping the algorithm from users who refuse — or fail — verification fundamentally changes the product experience and, by extension, ad targeting capabilities.

Age verification at scale also introduces serious privacy and infrastructure challenges. Any system capable of reliably verifying age typically requires collecting government ID data or integrating third-party identity verification services — both of which create new data liabilities and potential friction that could suppress sign-ups.

The rules represent one of the most technically specific age-assurance frameworks any US state has implemented, going beyond broad mandates to specify what compliance actually looks like in practice.

The Broader Regulatory Landscape

New York's move doesn't exist in isolation. Utah, Texas, Arkansas, and Florida have all passed child online safety legislation in recent years, though many faced immediate legal challenges. What distinguishes New York's approach is its focus on features rather than platform access entirely — a framing that may be more legally durable than outright access bans, which courts have repeatedly struck down on First Amendment grounds.

At the federal level, KOSA (Kids Online Safety Act) has stalled repeatedly in Congress, making state-level action the primary vector for this kind of regulation. New York, with its large user base and enforcement infrastructure, tends to set de facto national standards — platforms rarely build state-specific product variants at scale.

What This Means for Founders and Marketers

For startup founders building consumer social products, the implications are significant:

Algorithm-as-a-feature is now a regulated surface. If your growth strategy depends on personalized feeds, age verification becomes a compliance requirement, not an optional add-on.
Parental consent flows need to be built early, not retrofitted. The cost of re-engineering onboarding post-launch is substantially higher.
Ad targeting models for New York users may need to account for a segment of adults who opt for chronological feeds — reducing the behavioral signal available for retargeting.

For performance marketers, a meaningful reduction in algorithmic reach among non-verified users in New York could affect CPMs and campaign reach metrics, particularly in consumer verticals with younger-skewing audiences.

The rules are expected to take effect later in 2025. Platforms that haven't already begun compliance planning are already behind.