One figure has slipped under the radar: 98 percent. Under the final rules New York just published, that’s the rate at which a social platform will be required to catch users attempting to fake their way around an age check.
Not 80 percent. Not “reasonable efforts.” Ninety-eight.
The final rules implementing the SAFE for Kids Act came from New York Attorney General Letitia James (D). The underlying law was signed by Governor Kathy Hochul (D) in June 2024. What the rules do is lay out what covered platforms must actually build — standards for working out how old a user is, plus a mechanism for securing parental consent before a minor can access the walled-off features. Enforcement begins January 25, 2027, and after that date noncompliance carries penalties reaching $5,000 per violation.
What skipping verification costs you
Exactly two features sit behind the age wall, and neither is a fringe one: the algorithmic feed, and notifications between 12 AM and 6 AM.
Want either one as a New Yorker? Then you’re verifying your age. Those are the terms.
Who does this apply to? Platforms hosting user-generated content where users spend a minimum of 20 percent of their time on algorithmic feeds — a threshold drafted to land on precisely the companies you’d assume it was aimed at.
The rules dictate the standard, not the method
From a product perspective, this is the genuinely interesting wrinkle. No specific age-checking method is prescribed anywhere in the rules. Instead they impose accuracy floors: low false positive rates, alongside that 98 percent circumvention-detection threshold.
A platform could reach for government-issued ID as one path. But at least one additional option has to sit next to it, which means a design amounting to “upload your driver’s license or leave” won’t pass.
Any data gathered to perform the check must be deleted or de-identified immediately after it’s served its purpose. That’s the privacy safeguard on paper. In reality it amounts to a compliance promise nobody outside the company can independently audit — the identical structural weakness that has dogged every age-verification regime so far.
Consent rules cut in both directions
Anyone under 18 can request a parent’s permission to unlock the gated features, and the minor must consent to having their parent notified.
This is also where the rules anticipate the obvious abuse case. A minor can’t be shut out of the parts of the app that aren’t age-gated, nor prevented from searching for particular content, simply because no parent has approved the restricted features. Withholding consent means losing the algorithmic feed. It doesn’t mean losing the app.
Consent can be withdrawn later by either the parent or the child. And granting consent can’t be made conditional on the platform handing parents a view of their kid’s search history or the subjects they’re browsing.
That final point carries more weight than it first appears. It separates a permission system from a surveillance dashboard — and no shortage of “parental controls” builds have quietly opted for the latter.
Cue the lawsuits
By and large, the final rules resemble the AG’s original proposal from September. What’s changed is that final rules present something to shoot at.
Critics who contend age verification erodes the privacy and speech rights of New Yorkers are now free to seek an injunction. History is on their side, too: in other state age-verification fights, courts have frequently ruled in favor of the tech industry.
The terrain has moved, however. The Supreme Court’s decision upholding a Texas statute that requires age verification for access to adult websites widened the opening for rules of this kind. New York’s regime will be litigated against that precedent rather than the earlier run of tech-industry victories.
What to watch before 2027 arrives
January 25, 2027 may read as distant. It isn’t — not for anyone tasked with shipping an age-assurance system that clears a 98 percent circumvention-detection rate on every surface of the platform, provides a non-ID alternative, and disposes of its inputs on the way out.
For New Yorkers on Instagram or TikTok, the real question isn’t whether a verification prompt is coming. It’s which of the two routes each platform decides to build, and how good the non-ID one turns out to be — because that’s the route most people will choose.