| Jurisdiction | New York |
| Vehicle | New York FY27 enacted budget agreement (Safe By Design Act provisions attached) |
| Sponsor | Sen. Andrew Gounardes (D-NY), author of the standalone Safe By Design Act before it was attached to the budget |
| Signed by | Gov. Kathy Hochul (D), 2026-05-28 (via FY27 budget agreement) |
| Status | Enacted as part of FY27 budget |
The Safe By Design Act is a New York children's online-safety law requiring covered social-media, gaming, and digital-messaging platforms to limit adult contact with minor users, restrict access to minors' geolocation, require parental consent for under-13s, apply default design protections for under-17s without age verification, and default AI-companion access off for minors. It was advanced for two years as a standalone bill by Sen. Andrew Gounardes (D-NY) before being included in Gov. Kathy Hochul's FY27 enacted budget agreement on May 28, 2026 (Source: iapp.org).
Status and timeline
The act was enacted on May 28, 2026 as part of the FY27 budget agreement, after being carried for two prior years as a standalone Gounardes bill (Source: budget.ny.gov). It is, per IAPP, the first U.S. state framework combining children's online-safety and AI-companion defaults to be enacted through a budget vehicle rather than as standalone legislation (Source: iapp.org).
The enactment coincided with several other state actions on AI and privacy. The same day, Gov. Lamont signed Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox) (the broad Connecticut AI law) and Connecticut SB 4 — Data-broker registration + geolocation-sales ban + facial recognition (CTDPA amendment) (the Connecticut data-broker bill) in Connecticut, and the Illinois General Assembly passed Illinois SB 315 (frontier safety framework with mandatory third-party audits), with Gov. Pritzker's signature then pending (Source: iapp.org).
Scope and key provisions
The act covers social-media, gaming, and digital-messaging platforms. Covered platforms must:
- Restrict adults from interacting with underage users on the platform.
- Prevent children's geolocation information from being accessed by users they are not connected to.
- Require parental consent for minors under age 13 to access the platform.
- Apply default design protections for minors under 17, none of which require age verification.
- Default AI-companion access off for minors. Platforms offering AI companion features must set those off by default for users below the protected age.
The decision to require no age verification distinguishes Safe By Design from the federal Kids Internet and Digital Safety Act (KIDS Act), which has been criticized for de facto age-verification mandates. Gounardes framed the act as placing responsibility on platforms "to implement real privacy protections and meaningful safeguards so their platforms are no longer a place for rampant grooming of children."
The AI-companion default-off rule for minors places Safe By Design alongside Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox) (a flat under-18 ban) and California SB 243 — Companion Chatbots (age-gated rules) among early state-level legislation treating AI companions as a regulated product category. The three laws adopt three different design choices, a flat ban, default-off, and age-gated rules, across three states with Democratic trifectas.
Federal preemption and the state-AG coalition
The same day Hochul attached Safe By Design to the budget, NY AG Letitia James joined 43 state attorneys general in opposition to the federal KIDS Act, arguing in a letter to congressional leaders coordinated through the National Association of Attorneys General (NAAG) that the KIDS Act would prevent states from enforcing their children's privacy laws and potentially shield technology companies from accountability under existing state frameworks (Source: naag.org).
James stated: "Online platforms are fueling a mental health crisis among young people, and New York has led the way to enact new measures to protect our kids. The KIDS Act would strip states of their ability to protect our children online."
The simultaneity reflects a coordinated state-preservation pattern documented under AI Federalism and State-Level AI Regulation: New York enacting state law on the same day its attorney general led a bipartisan coalition opposing federal preemption. Proponents have argued that the budget-vehicle attachment complicates preemption litigation, on severability and timing grounds, and that the no-age-verification architecture offers a less intrusive design than the federal preemption candidate.
Relationships
- paired-with-coalitions: the 43-state-AG opposition to the federal KIDS Act (led by Letitia James, also May 28, 2026)
- modeled-on / kindred: California SB 243 — Companion Chatbots (companion AI / minors), Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox) (CT broad AI law, signed same day), Age Appropriate Design
- contradicts: the federal KIDS Act (preemption thread), EO — Trump Federal Preemption of State AI Laws (Dec 11, 2025)
- related: AI and Children, State-Level AI Regulation, AI Federalism, California Effect, Letitia James, Andrew Gournardes (sponsor), Garcia v. Character Technologies, Inc., Pennsylvania v. Character.AI (driving facts), Character.AI, Meta AI (covered as social-media platform)
Sources
- IAPP — "Notable AI, privacy bills hit finish line in Illinois, Connecticut and New York" (May 28, 2026) (Source: iapp.org)
- New York State Budget Division — FY27 enacted-agreement summary (Source: budget.ny.gov)
- NAAG (National Association of Attorneys General) — letter from 44 AGs opposing the federal KIDS Act, May 2026 (Source: naag.org)