Sometime after Jan. 25, a 16-year-old opening her favorite app anywhere in New York may meet a screen the state effectively wrote for her. It has to name the platform and her account. It has to tell her, in plain language, that state law bars the company from building her feed out of what it knows about her without a parent's consent. And it has to say she can keep using the app with a different feed while any request is pending.

That screen is the visible edge of the SAFE for Kids Act, the 2024 law that takes effect on Monday, Jan. 25, 2027. The date falls 180 days after its implementing rules were published in the State Register on July 29. Attorney General Letitia James and Gov. Kathy Hochul released the final rules the day before, answering the question that has hung over the law since Hochul signed it in June 2024. How is a platform supposed to know who is 17 and who is 18, and what does it owe each of them once it does? The companion Child Data Protection Act is already in effect.

For families, four changes arrive at once. Users under 18 lose the personalized, algorithmic feed by default and see posts from accounts they follow or select, in an order such as newest first. Feed-related alerts stop between midnight and 6 a.m. Eastern. Platforms must offer a way to prove age that does not require a government ID. A parent can switch the old features back on only after the teenager asks for them and agrees to bring the parent in.

What Your Teen's Feed Will Look Like

The law targets what the rule calls an addictive feed. That means any stream of user posts a platform recommends, selects, or ranks using information tied to the user or their device, including how they have interacted with other people's posts. Without parental consent, a minor will see content only from accounts they follow or otherwise choose, in a set sequence such as chronological order. According to the attorney general's release, a platform may not block a minor from the app or its content, including through search, simply because they or their parent refused consent.

The rule also spells out what does not count, and the exceptions describe a fairly ordinary app. Search results are allowed, as is the next video in a series from the same creator. So are posts shared into a page or group the teen subscribes to, along with anything they expressly ask to see, prioritize, or block. Direct, private messages are carved out of the definition entirely, which leaves the group chat outside what Albany set out to regulate.

Not every app is covered. A platform falls under the rule only when its monthly active users spend at least 20 percent of their time on addictive feeds. Services with fewer than 5 million monthly users, or fewer than 20,000 monthly users the company knows to be New York minors, are exempt unless their primary audience is children.

The Midnight Rule

From 12 a.m. to 6 a.m. Eastern, covered platforms may not send a minor nighttime notifications without parental consent. The rule text defines those as notifications concerning an addictive feed and exempts any alert that federal, state, or local law requires. The target is the overnight stream of recommendation pings rather than every buzz a phone can make. Families should not assume the phone goes silent at midnight, since messages from friends sit outside the feed definition.

State officials tied the provision to sleep, citing research linking algorithmic feeds and late-night alerts to depression, anxiety, and eating and sleep disorders among teenagers. When the rules were announced at a roundtable at the Brooklyn STEAM Center, Hochul aimed her remarks at the companies rather than at parents. "Social media companies, you're now on notice," she said, according to WWNY. "The regulations are done; you have 180 days to come into compliance."

Who Has to Ask First

According to the release, minors "must affirmatively seek access to prohibited features and must consent to their parent being notified." A platform reaches a parent only after the teenager has asked for the personalized feed or the overnight alerts and agreed to loop the parent in. If the parent says no, the company may ask again only when the teenager requests it. The rule does not require platforms to offer minors a consent path at all, which leaves room for some companies to ship the chronological version to everyone under 18 and stop there.

A parent who does receive a request will learn very little from it. The notice may not reveal the teen's activity, the content in her feed, the accounts she interacts with, or her settings. The release adds that platforms do not have to show parents a child's search history or topics of interest. Before granting verifiable parental consent, the parent must clear an age check, and the process must include at least one option that requires neither a government ID nor an account with the platform.

Instructions must be available in the 12 most commonly spoken languages in the state, a group that includes Spanish, Chinese, Russian, Yiddish, Bengali, Korean, and Haitian Creole. Withdrawing consent has to be at least as easy as granting it. Nobody can be forced to reach a live representative to take consent back if they did not need one to give it.

How Platforms Will Check Age

The age assurance standards are where the rules get most specific. A platform must treat a user as a minor once it has actual knowledge, which includes her own stated age or marketing data that marks her as one. A 15-year-old who entered her real birthday at sign-up is covered without any new check. Anyone the company wants to serve an algorithmic feed as an adult has to pass a certified method that returns an adult result.

Each method must be certified every year by an accredited third party and clear accuracy floors that tighten as age falls. The rule tolerates mistaking a minor for an adult no more than 0.1 percent of the time for children 7 and younger and 1 percent for ages 8 through 13. The ceiling rises to 2 percent for 14- and 15-year-olds, 8 percent at 16, and 15 percent at 17. Every method must also catch at least 98 percent of attempts to fool it, and companies keep the test results for 10 years.

The release lists an uploaded image or video, or an email address or phone number cross-checked against other records, as acceptable approaches. Every platform must offer at least one alternative to a government ID. The Ali Forney Center's Nadia Swanson said in the release that by "providing multiple age verification options that protect user anonymity, Attorney General James has recognized the unique risks that identity verification technologies can pose to LGBTQIA+ and immigrant communities."

Anything collected to confirm age or consent can be used only for that purpose, must be the minimum necessary, and must be deleted or de-identified once the job is done. Platforms also have to weigh device and location data to decide who counts as a New York user. They must take reasonable steps to catch users who conceal their location, which reaches the teenager who routes her phone through an out-of-state VPN.

Mistakes run in both directions. An adult wrongly flagged as a minor gets an appeal that must accept at least one form of proof other than a government ID, with a response due within 10 business days. A teen who turns 18 must be given a way to update her status. When a platform learns that someone it treated as an adult is actually a minor, it has 10 business days to make the switch.

The Fight Still Ahead

New York's head start over Washington, which The Standard reported on when the House passed its own kids' online safety package in June, now has a date attached. The industry has not accepted it. NetChoice, the trade group whose members have included Meta and Google, answered the day after the rules came out with a statement calling them unconstitutional. "New York doesn't need to replace parents," said Amy Bos, its vice president of government affairs. The group pointed to injunctions it has won against laws in California and Arkansas and warned that age-check data becomes a new target for breaches.

The closest legal parallel points the other way. California's SB 976 rests on the same idea of restricting personalized feeds for minors. In September 2025, the Ninth Circuit Court of Appeals declined to block its personalized-feed provisions in NetChoice's challenge, a case in which New York joined other states in a brief defending California. A lawsuit filed here could still disturb the January calendar. Once the law takes effect, it authorizes the attorney general to seek civil penalties of up to $5,000 per violation.

What Families Can Do Before Jan. 25

James described the rules as a demand on the companies. "These rules set standards for age verification and parental control to ensure tech companies are doing their part to keep kids safe on their platforms," she said in the release. What the rules change is a default setting. The habits around a phone still get built at home. That is the territory of The Standard's guide to talking with your teen about social media, which suggests a family agreement to charge phones outside the bedroom overnight.

The law also has edges worth knowing. It is written around feeds of posts shared by other users, so it does not reach the AI companion chatbots that Family Symposium reported seven in ten teens have tried, often without a parent knowing. Over the next 14 weeks, two dinner-table questions will tell a parent most of what Jan. 26 looks like at home: which app their teenager opens first, and whether the birthday on that account is real.