N.Y. Gen. Bus. Law § 1540

* § 1540. Privacy by default and parental approvals. 1. (a) The\nattorney general may promulgate rules and regulations identifying\nmethods for reasonable and technically feasible age assurance, which may\nconsider the size, financial resources, and technical capabilities of\ncovered platforms, the costs and effectiveness of available age\ndetermination techniques for users of such platforms, the audience of\nsuch platforms, and prevalent practices of the industry of the operator.\nSuch rules or regulations may also identify the appropriate levels of\naccuracy that would be considered reasonable for operators to achieve in\ndetermining whether a user is a covered minor. Such rules or regulations\nmay specify that information collected under this article shall not be\nused for any purpose other than age assurance and shall be deleted\nimmediately after an attempt to determine a user's age, except where\nnecessary for compliance with any applicable provisions of New York\nstate or federal law or rule or regulation.\n (b) Until such time as the rules or regulations referenced in\nparagraph (a) of this subdivision may have been promulgated and are in\neffect, an operator shall use age assurance methods that meet the\nrequirements of article forty-five of this chapter and its implementing\nrules or regulations, as amended, except that for purposes of this\narticle, an operator may not use self-declaration of age or minor status\nto determine whether a covered user is a covered minor.\n (c) To the extent rules or regulations referenced in paragraph (a) of\nthis subdivision are not in effect and rules or regulations referenced\nin paragraph (b) of this subdivision regarding age assurance methods\npromulgated pursuant to article forty-five of this chapter are not in\neffect, an operator shall rely on a determination of a covered user's\nage made using a reasonable age assurance method that meets the\nfollowing requirements:\n (i) such age assurance method shall reasonably guard against\ncircumvention and reasonably minimize the retention of information\ncollected for age assurance purposes;\n (ii) an operator may not use self-declaration of age or minor status\nto determine whether a covered user is a covered minor; and\n (iii) an operator must make available more than one age assurance\nmethod to covered users, including at least one method that either does\nnot rely on government issued identification or that allows a covered\nuser to maintain anonymity as to the operator.\n 2. An operator may not offer or make available to a covered user the\nfeature of communicating privately with a user within the covered\nplatform or through platform integration, viewing the full profile of a\nuser, responding to or downloading media created or posted by a user,\ntagging a user in posted media or viewing the geographic location\ninformation of a user, unless the operator has conducted age assurance\nto determine whether a covered user is a covered minor.\n 3. For all users determined by an operator to be a covered minor, such\noperator shall utilize the following settings by default for covered\nminors, which shall ensure that no user age eighteen or older who is not\nalready connected to a covered minor may:\n (a) communicate privately with such covered minor within the covered\nplatform or through platform integration;\n (b) view the full profile of such covered minor;\n (c) respond to or download media created or posted by such covered\nminor;\n (d) tag such covered minor in posted media; or\n (e) view the geographic location information, where such information\nis derived from or captured by device or network signals, including but\nnot limited to global position system, IP address or Wi-Fi positioning,\nof such covered minor.\n 4. If an operator provides a mechanism on the covered platform to\nsuggest or recommend the profile of a user to another user to connect\nwith, an operator may not suggest or recommend the profile of a covered\nminor to another user age eighteen or older who is not already connected\nto such covered minor. This subdivision shall not apply to profile\nsuggestions or recommendations that are made as a result of a covered\nminor or other user syncing contacts with a covered platform.\n 4-a. Nothing in this subdivision is intended to prohibit actions\nreasonably necessary for platform safety, abuse prevention, customer\nsupport, legal compliance or emergency response, as may be further\ndefined in rules or regulations promulgated by the attorney general.\n 5. (a) A parent of a covered minor may override the default privacy\nsettings provided in subdivisions three and four of this section at such\nparent's discretion. An operator shall allow a parent to override or\nmaintain each setting provided in subdivision three of this section\nseparately.\n (b) An operator shall notify a parent of a covered minor whenever such\ncovered minor requests that the operator obtain approval from a covered\nminor's parent to consent to change a default setting provided in\nsubdivision three or four of this section. Such notice shall include a\nstatement that informs the parent that they are changing a default\nsetting required under New York law. The parent may then either provide\nor withhold such consent to the request to change the settings for such\nminor, provided there is separate consent provided for each request by a\ncovered minor.\n 6. A request by a user to connect with a covered minor may be sent\nsimultaneously with a request by such user to communicate privately with\nsuch covered minor and a request by a covered minor to connect with a\nuser may be sent simultaneously with a request by such covered minor to\ncommunicate privately with such user, provided, however, that no such\nprivate communication may be returned or responded to, until the\nconnection has been approved and/or any parental consent required by\nsubdivision eight of this section has been provided.\n 7. (a) An operator may not offer or make available to a covered user\nthe use or access of an integrated AI companion, unless the operator has\nconducted age assurance to determine whether a covered user is a covered\nminor.\n (b) An operator shall, by default, disable the access or use of any\nintegrated AI companion for any covered minor.\n (c) A parent of a covered minor may override the default disabled\naccess or use of an integrated AI companion, provided in paragraph (b)\nof this subdivision, at such parent's discretion. An operator shall\nallow a parent to override or maintain the setting provided for in\nparagraph (b) of this subdivision separately from any other mechanisms\nto override other default settings.\n (d) An operator shall notify a parent of a covered minor whenever such\nminor requests that the operator obtain consent from such covered\nminor's parent to change the default setting provided in paragraph (b)\nof this subdivision. Such notice shall include a statement that informs\nthe parent that the parent is being asked to provide consent to change a\ndefault setting required under New York law. The parent may thereafter\nprovide or withhold such consent.\n 8. (a) For any covered minor under the age of thirteen, an operator\nshall require the parent of such covered minor to provide consent before\nthe account of such covered minor and the account of another user may be\nconnected. For any covered minor under the age of thirteen, an operator\nshall also establish a mechanism by which a parent of such minor may\neasily view the list of all users or accounts currently connected with\nthe account of the minor.\n (b) For any covered minor, an operator shall establish a mechanism by\nwhich a parent of such minor may easily view a list of any covered\nplatforms that have been linked to or requested to be linked to the\naccount of the minor, if the covered platform offers a mechanism for\nplatform integration.\n 9. (a) An operator of a covered platform that offers or provides the\nfeature described in item two of clause (B) of subparagraph (ii) of\nparagraph (c) of subdivision twelve of section fifteen hundred\nthirty-nine of this article, may not offer or make available such\nfeature to a covered user unless the operator has conducted age\nassurance to determine whether a covered user is a covered minor.\n (b) For all users determined by such operator to be a covered minor,\nsuch operator shall establish a mechanism that either: (i) enables the\nparent of such covered minor to set a monthly limit on the spending of\nmoney, whether by charging a credit card or other means, in connection\nwith the direct or indirect purchase or acquisition of anything on or\nvia the covered platform, including but not limited to digital currency,\nrelating to such covered minor's account and where the amount of such\nlimit is set at the parent's discretion; or\n (ii) enables the parent of such covered minor to opt out of setting\nsuch limits.\n (c) Such an operator may establish a mechanism to enable the covered\nminor to request that the operator obtain consent from the parent of\nsuch covered minor for the further expenditure of money, such as\ncharging the credit card associated with such covered minor's account,\nonce the limit set forth in subparagraph (i) of paragraph (b) of this\nsubdivision is reached. In such an instance, the operator shall obtain\nsuch consent from such parent before any such charges may be processed\nby the operator.\n (d) Such operator shall further establish a mechanism by which a\nparent of a covered minor may easily view a history of all financial\ntransactions relating to such covered minor's account at any time, which\nat a minimum, identifies the users involved in each such transaction, in\naddition to the covered minor, as well as the amounts of money or\ndigital currency associated with each transaction.\n * NB Effective January 1, 2027\n