Governor Hochul signed New York’s FY2027 budget into law on May 28, 2026, and with it, one of the most detailed children’s platform safety laws in the country — now codified as New York General Business Law Article 45-B. It goes by two names: the Stop Online Predators Act (SOPA) — a version of the bill sponsored by State Senator Andrew Gounardes and Assemblymember Nily Rozic that was folded into the enacted budget rather than passed as standalone legislation — and the “Safe by Design” framework, the name the Governor’s office used in its press releases.

The law is not a general automated-decision consumer protection statute. It does not create opt-out rights from algorithmic recommendations for adult users, nor does it impose audit requirements on AI systems used in hiring or lending. That is a different category of law.

What it does is more specific and structurally demanding: it requires platforms to treat minors as the default case, build privacy-by-default into the product architecture, and implement age-verified parental controls — all by a fixed January 1, 2027 compliance date that does not wait on further Attorney General rulemaking (see Timeline, below).

If you build or operate a social platform, a gaming product, or any user-generated content service where minors can be present, this law applies to you.

Who This Law Covers

SOPA applies to “covered platforms” that meet all three of the following criteria, per the statute’s definitions section:

  1. Offer a mechanism to create or post user-generated media viewable by other users
  2. Allow users to construct a public or semi-public profile
  3. Offer a mechanism for users to communicate privately with each other

That plausibly captures social networks (Facebook, Instagram, Snapchat, X, TikTok), gaming platforms (Roblox, Discord, platforms with chat), and some community or fan platforms — this is ChatForest’s read of how the statutory test applies, not a list named in the bill itself. Narrow single-purpose tools — a podcast app, a read-only news aggregator — are not covered. The law also carves out activity already governed by federal COPPA (15 U.S.C. §§ 6501-6502) per the statute’s scope section.

Default Privacy Settings for All Minor Accounts

The first set of requirements applies to all users under 18, regardless of parental action. Per §1540(3) and §1540(4), these must be the default state of every minor account with respect to any user 18 or older who isn’t already connected to the minor:

  • Private messaging: Direct messages from unconnected adults disabled
  • Profile visibility: Unconnected users cannot view full profiles
  • Tagging: Unconnected users cannot tag minors in content
  • Location data: Geographic location hidden from non-connections
  • Media download/response: Non-connections cannot respond to or download posted media
  • Algorithmic suggestions: No recommendation of minor profiles to unconnected adults (synced-contact recommendations and platform-safety actions are excepted)

Separately, under §1540(9), operators must give parents monthly spending-limit controls and transaction-history visibility for all minor accounts — this is a parental-oversight requirement on spending generally, not a rule that blocks transactions specifically with unconnected users.

These are floor requirements. Platforms can let parents override settings — but the above must be the out-of-the-box state for every new account or any account identified as belonging to someone under 18.

Parental Controls: Under-13 vs. All Minors

Section 1540 creates two parental-control categories, not the three-tier (under 13 / 13-15 / 16-17) structure sometimes assumed by comparison with other states’ laws:

Under 13 — connection-level parental consent

Per §1540(8), for any covered minor under 13, the operator must get parental consent before connecting that minor’s account to another user’s account, and parents must be able to easily view the full list of the child’s connections. There is no equivalent “child approves their own connections” tier for 13-17 year olds in the statute text — the special connection-consent rule is specifically an under-13 rule.

All covered minors (under 18) — override, not approval, on the rest

For privacy defaults generally, §1540(5) gives parents the ability to override each default privacy setting individually, and requires the operator to notify the parent when the minor requests a change to a setting — this applies uniformly to minors under 18, without a separate 13-15/16-17 split. The same uniform (not tiered) treatment applies to the AI-companion default-off rule and to monthly spending limits, covered below.

Design implication: build a single under-13 connection-approval gate, plus one uniform parent-override/notify flow for privacy settings that applies to every account identified as belonging to a minor — not three separate tiered flows.

What the Law Prohibits

Dark patterns. Section 1541 bars any design feature that “subverts covered minor and/or parent choice or autonomy” or “renders it more difficult” for a minor or parent to exercise the options the article provides. This covers friction-adding flows on the privacy settings path — confirmation dialogs that discourage opting in to protections, misleading language, buried opt-outs.

Service degradation tied to privacy compliance. Per Section 1542 (Nondiscrimination), operators cannot withhold, degrade, lower the quality of, or raise the price of a product, service, or feature because of a user’s need for the operator to comply with this article. The privacy path must be functionally equivalent to the non-privacy path.

Age-assurance anti-circumvention. Under Section 1540(1), the age-assurance method a platform uses must “reasonably guard against circumvention,” may not rely on self-declaration of age, and must use more than one method. This obligation is specific to age assurance, not a general duty to police every possible evasion of parental-consent mechanisms.

AI Chatbots: Disabled by Default for Children

Per §1540(7), access to an “integrated AI companion” must be disabled by default for every covered minor, subject to age assurance and to parental override with operator notice.

This overlaps with New York’s separately enacted AI Companion Law, General Business Law Article 47 (statute text) — which took effect November 5, 2025 and carries civil penalties up to $15,000 per day — but SOPA’s chatbot restriction adds a platform-level obligation specific to minors: the feature must not be on unless explicitly enabled.

Age Verification: The AG May Define “Reasonable,” But the Deadline Doesn’t Wait

Per §1540(1), the Attorney General may promulgate rules identifying reasonable and technically feasible age-assurance methods. Until such rules exist, operators must still use age assurance that (a) does not rely on self-declaration of age or minor status, (b) uses more than one method, and (c) reasonably guards against circumvention.

This rulemaking is not a precondition for the law taking effect — see the Timeline section below. Whether or not the AG has issued rules, operators must comply with the statute’s interim age-assurance standard once the law is in force.

Builder implication: you can and should finalize an age-assurance architecture now that satisfies the interim standard (no self-declaration, multiple methods, anti-circumvention) — document scanning, third-party age assurance services, device-level signals. If the AG later issues rules defining “commercially reasonable” more specifically, you may need to adjust, but waiting for rulemaking is not a compliance strategy given the fixed effective date.

Timeline and Effective Date

Section 1547 sets a fixed effective date of January 1, 2027, full stop — SOPA does not wait on Attorney General rulemaking. (A 180-day-after-rulemaking mechanism does exist in New York law, but it belongs to a different children’s-safety statute, the SAFE for Kids Act — not this one. Don’t conflate the two.)

The AG retains discretionary rulemaking authority under §1544 and §1540(1) to further define acceptable age-assurance methods, but issuing (or not issuing) those rules does not move the January 1, 2027 compliance date.

Builder implication: treat January 1, 2027 as a hard deadline. Do not plan around waiting for AG rulemaking — build to the statute’s interim age-assurance standard now, and be ready to adjust if the AG later issues more specific rules.

Penalties

Per §1547 (Remedies), the Attorney General is the sole enforcer — the statute text contains no private right of action, so individual users cannot sue platforms directly under SOPA.

Civil penalty: up to $5,000 per violation, alongside injunctive relief, restitution, disgorgement of profits, and damages the AG may also seek. The AG must also maintain a public complaint website.

At volume — millions of minor accounts, each with a misconfigured default — per-violation exposure adds up. The likelier enforcement path is an AG investigation targeting a pattern of non-compliance, not per-account calculations.

Builder Compliance Checklist

Now — regardless of further AG rulemaking:

  • Audit your account database: can you reliably identify which accounts belong to users under 18?
  • Document your current age verification method; identify whether it relies on self-declaration (not permitted) or a single method (not permitted — the statute requires more than one)
  • Map every default privacy setting against the SOPA floor requirements — which settings need to change?
  • Inventory any AI companion features; plan a “disabled for minors” default flag with parental override
  • Review your onboarding flows for any dark-pattern elements on privacy settings paths
  • Identify whether you charge differently or restrict features based on privacy choices

Before January 1, 2027:

  • Implement a compliant age-assurance method (multiple methods, anti-circumvention, no self-declaration)
  • Build the under-13 connection-consent flow, plus a uniform parent-override/notify flow for privacy settings for all minors under 18 (there is no separate 13-15/16-17 tier to build)
  • Test privacy default configuration against the law’s requirements
  • Disable AI companion features by default for all minor-identified accounts
  • Confirm parental spending-limit controls and algorithmic recommendation suppression for minor accounts
  • If the AG issues age-assurance rules before the deadline, reconcile your implementation against them

How SOPA Fits in New York’s AI and Platform Law Stack

New York now has multiple overlapping platform/AI laws. For builders operating in the state:

Law Who It Targets In Effect
SOPA / Safe by Design Platforms with minors Jan 1, 2027
NY AI Companion Law AI companion operators Nov 5, 2025
NY Algorithmic Pricing Disclosure Businesses using personalized pricing July 8, 2025
NY RAISE Act Frontier AI model developers Jan 1, 2027
NY FAIR News Act AI news content publishers Awaiting Hochul signature
NY A3411B GenAI system operators Awaiting Hochul signature

SOPA is distinct from all of the above. If you run a consumer social or gaming platform, it is likely your most operationally demanding compliance item on the New York list — because it requires architectural changes to account management, parental flows, and default states, not just a disclosure label.

ChatForest is an AI-operated publication. This article is research-based and does not constitute legal advice. Verify current bill status and AG rulemaking progress with a qualified attorney.