New York

Plain:Set covered minors' accounts, by default, to restrict unconnected users from sending them direct messages, viewing their full profile, tagging them, viewing their location data, downloading their media, and engaging in financial transactions with them.

Engineering:For accounts determined to be covered minors, default privacy settings so that non-connections cannot DM, see the full profile, tag, view location, download media, or transact; require an explicit setting change (subject to the age-tiered parental-control rules) to relax any of these.

Statute’s own ages: Applies to 'covered minors' (users under 18).

Plain:Do not recommend or suggest a covered minor's profile to unconnected users (except through synced contacts), do not use dark patterns that undermine the parental or user controls the Act requires, and do not degrade service quality or raise prices to discourage minors from keeping stronger privacy settings.

Engineering:Exclude covered-minor profiles from people-you-may-know / recommendation surfaces to non-connections (synced-contacts path excepted); do not deploy deceptive-design flows that steer users away from the required controls; do not gate features or pricing on privacy-setting strength.

Statute’s own ages: Applies to users under 18.

Plain:Use commercially reasonable and technically feasible age-assurance methods (as defined by Attorney General rule, and beyond mere self-declaration) to determine which users are covered minors; delete age-assurance data immediately after the determination and do not use it for other purposes.

Engineering:Implement the AG-approved age-assurance methods (which the rulemaking must specify, including accuracy minimums addressing false negatives, false positives, and circumvention) to classify covered minors; purge verification inputs immediately post-determination and scope them to age assurance only. Specific acceptable methods are the core subject of the pending rulemaking.

Statute’s own ages: Applies to users under 18; methods and accuracy minimums to be set by AG rulemaking.

Plain:Provide age-tiered parental controls: for users under 13, a parent must approve friend/connection requests and may view the minor's contact list; for users 13-15, the minor may approve requests and a parent is notified of privacy-setting changes; for users 16-17, the minor controls requests and a parent is notified of (but cannot block) privacy-setting downgrades. For all users under 18, a parent must approve financial transactions.

Engineering:Implement three control tiers keyed to the age determination: under-13 = parental approval gate on connection requests plus parental contact-list visibility; 13-15 = self-approval with parental notification on setting changes; 16-17 = self-control with notification-only on downgrades; all under-18 = parental approval gate on financial transactions.

Statute’s own ages: Three statutory tiers (under 13, 13-15, and 16-17) plus an under-18 rule for financial-transaction approval.

Plain:On covered platforms, set AI companion / chatbot features to off by default for covered minors.

Engineering:Default AI-companion features to disabled for accounts determined to be covered minors on covered platforms.

Statute’s own ages: Applies to covered minors (users under 18).

Plain:Do not provide an algorithmically personalized ('addictive') feed to a user the platform knows to be a minor without verifiable parental consent; otherwise show a chronological or non-personalized feed.

Engineering:Gate algorithmic ranking behind a verified-minor + parental-consent check; default known-minor accounts to a reverse-chronological or follows-only feed absent consent.

Statute’s own ages: Applies to users under 18; no narrower statutory subdivision.

Plain:Do not send notifications about an addictive feed to a known minor between 12:00 a.m. and 6:00 a.m. (Eastern) without verifiable parental consent.

Engineering:Suppress addictive-feed push notifications to known-minor accounts during the 00:00-06:00 ET window unless parental consent is on file.

Statute’s own ages: Applies to users under 18.

Plain:Use commercially reasonable and technically feasible methods (to be defined by OAG rule) to determine which users are minors and to obtain verifiable parental consent.

Engineering:Implement the OAG-approved age-assurance and parental-consent methods once final; the specific acceptable methods are the core subject of the pending rulemaking.

Statute’s own ages: Applies to users under 18.