Here’s the number nobody’s talking about: 98 percent. That’s how often a social media platform will have to catch someone trying to fake their way past an age check in New York, under final rules the state just published.
Not 80 percent. Not “reasonable efforts.” Ninety-eight.
New York Attorney General Letitia James (D) released the final rules implementing the SAFE for Kids Act, the law Governor Kathy Hochul (D) signed in June 2024. The rules spell out what covered platforms have to actually build: standards for determining a user’s age, and a process for getting a parent’s consent before a kid can use the walled-off stuff. The law takes effect January 25, 2027. Miss the mark after that, and noncompliance can run up to $5,000 per violation.
What you lose if you don’t verify
Two features get locked behind the age wall, and they’re not obscure ones. The algorithmic feed. And notifications between 12 AM and 6 AM.
If you’re a New Yorker who wants either of those, you’re verifying your age. That’s the deal.
The obligation lands on platforms that host user-generated content and whose users spend at least 20 percent of their time on algorithmic feeds. Which is a threshold written to catch exactly the companies you’d expect it to catch.
The rules don’t tell you how, just how well
This is the part I find genuinely interesting from a product standpoint. The rules don’t prescribe a method for checking ages. They set accuracy floors instead: low false positive rates, plus that 98 percent circumvention-detection bar.
Government-issued ID is one route a platform could take. But the rules require at least one other option alongside it, so “upload your driver’s license or leave” isn’t a compliant design.
Whatever data gets collected to run the check has to be immediately deleted or de-identified once it’s been used. On paper, that’s the privacy backstop. In practice, it’s a compliance promise you can’t independently audit from the outside, which is the same structural problem every age-verification regime has run into.
Parental consent has guardrails pointing both directions
Kids under 18 can ask a parent for permission to unlock the gated features, and the kid has to consent to their parent being notified.
But here’s where the rules push back against the obvious abuse case. A platform can’t lock a minor out of the non-age-gated parts of the app, or block them from searching for specific content, just because a parent hasn’t signed off on the restricted features. No consent means no algorithmic feed. It doesn’t mean no app.
Both parents and kids can withdraw consent later. And the platform isn’t obligated to show parents anything about their kid’s search history or the topics they’re looking at as a condition of granting consent.
That last detail matters more than it sounds. It’s the difference between a permission system and a surveillance dashboard, and plenty of “parental controls” implementations have quietly chosen the second one.
Now the lawsuits
The final rules look largely similar to the AG’s initial proposal back in September. The difference is that final rules are a target.
Opponents who argue age verification cuts into New Yorkers’ privacy and speech rights can now move to block it. And they’ve got a track record: courts have often sided with the tech industry in blocking other state age-verification laws.
The ground shifted, though. When the Supreme Court upheld a Texas law requiring age verification to access adult websites, it opened the door further to these requirements. That’s the precedent New York’s rules will be litigated against, not the older string of tech-industry wins.
What to watch between now and 2027
January 25, 2027 sounds far away. It isn’t, for anyone who has to ship an age-assurance system that hits a 98 percent circumvention-detection rate across every platform surface, offers a non-ID alternative, and deletes its inputs on the way out.
If you’re in New York and you use Instagram or TikTok, the practical question isn’t whether you’ll be asked to verify. It’s which of the two options the platform builds, and whether the non-ID one is any good, because that’s the one most people are going to pick.
