Add Art 45-B §§1540 - 1548, amd §899-ii, Gen Bus L
Requires manufacturers of internet-enabled devices to conduct age assurance to determine a user's age category and provide all websites, online services, online applications and mobile applications on such user's internet-enabled device and/or application store manufactured by the covered manufacturer with a digital signal that such user is a covered minor as well as the age category of such covered minor via a real-time application programming interface (API).
STATE OF NEW YORK
________________________________________________________________________
8102--B
2025-2026 Regular Sessions
IN SENATE
May 15, 2025
___________
Introduced by Sens. GOUNARDES, SUTTON -- read twice and ordered printed,
and when printed to be committed to the Committee on Consumer
Protection -- recommitted to the Committee on Consumer Protection in
accordance with Senate Rule 6, sec. 8 -- committee discharged, bill
amended, ordered reprinted as amended and recommitted to said commit-
tee -- committee discharged, bill amended, ordered reprinted as
amended and recommitted to said committee
AN ACT to amend the general business law, in relation to device-level
age assurance
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new article
2 45-B to read as follows:
3 ARTICLE 45-B
4 DEVICE-LEVEL AGE ASSURANCE
5 Section 1540. Definitions.
6 1541. Obligations for operating system providers.
7 1542. Obligations for covered developers.
8 1543. Nondiscrimination.
9 1544. Data security.
10 1545. Limitations.
11 1546. Rulemaking authority.
12 1547. Scope.
13 1548. Enforcement.
14 § 1540. Definitions. For the purposes of this article, the following
15 terms shall have the following meanings:
16 1. "Age assurance" shall mean a method to reasonably determine the age
17 category of a user that meets the requirements of article forty-five of
18 this chapter and its implementing rules or regulations, or a method that
19 is identified pursuant to new regulations promulgated by the attorney
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD13065-17-6
S. 8102--B 2
1 general consistent with section fifteen hundred forty-six of this arti-
2 cle.
3 2. "Age category" shall mean data that a user is (a) under the age of
4 thirteen years; (b) at least thirteen but under sixteen years; (c) at
5 least sixteen but under eighteen years; or (d) at least eighteen years.
6 3. "Application programming interface" or "API" shall mean a system
7 that allows two or more software systems to communicate and exchange
8 information, features, and functionality.
9 4. "Covered developer" shall mean a person who owns or controls a
10 software application that may run on an internet-enabled device and
11 which is accessed by a user in the state of New York.
12 5. "Covered minor" shall mean a user under the age of eighteen.
13 6. "Family account application" shall mean a software application that
14 uses a method of age assurance, as defined in subdivision one of this
15 section, to reasonably determine that the primary account holder of such
16 application is at least eighteen years of age, and which offers sub-ac-
17 counts or user profiles within such application.
18 7. "Internet-enabled device" shall mean and include any desktop,
19 laptop, smartphone, tablet, or other device capable of connecting to the
20 internet and enabling the user to access content on the internet.
21 8. "Operating system" shall mean the system software that manages the
22 hardware of an internet-enabled device and allows programs and applica-
23 tions to run on such device.
24 9. "Operating system provider" shall mean any person, partnership,
25 association, firm, business, or other legal entity, or any member there-
26 of, who develops, licenses, or controls an internet-enabled device's
27 operating system.
28 § 1541. Obligations for operating system providers. 1. Upon activation
29 of an internet-enabled device after the effective date of this article,
30 an operating system provider shall conduct age assurance to determine a
31 user's age category at the point of such activation.
32 2. For devices that were activated prior to the effective date of this
33 article, such operating system provider shall conduct the age assurance
34 described herein within one hundred eighty days of such effective date.
35 3. An operating system provider shall provide a covered developer with
36 a digital signal indicating the age category of a user via a real-time,
37 reasonably consistent application programming interface (API) upon
38 receiving a request for such signal from such developer.
39 § 1542. Obligations for covered developers. 1. All covered developers
40 shall request an age category signal for a user from an operating system
41 provider at the point at which such user downloads and launches such
42 developer's application after the effective date of this article.
43 2. For all applications downloaded and launched prior to the effective
44 date of this article, covered developers shall request such age category
45 signal within one hundred eighty days of such effective date.
46 3. If the signal indicates that a user is a covered minor, then such
47 covered developer shall treat such signal as an authoritative indicator
48 of such user's age for the purposes of compliance with any applicable
49 law and the covered developer shall be deemed to have actual knowledge
50 that a user is a covered minor across all platforms and points of access
51 of the application, including where such minor accesses the application
52 via a website or browser; provided, however, that a covered developer
53 shall not willfully disregard clear and convincing information otherwise
54 available to the developer that indicates a user's age is different than
55 that indicated by the age category signal provided by an operating
56 system provider.
S. 8102--B 3
1 § 1543. Nondiscrimination. 1. An operating system provider shall
2 impose at least the same restrictions and obligations on its own appli-
3 cations as it imposes on the applications of third parties.
4 2. An operating system provider shall not withhold, degrade, lower the
5 quality, or increase the price of any product, service, or feature to a
6 user due to the provisions of this article, other than as necessary for
7 compliance with the provisions of this article.
8 § 1544. Data security. 1. An operating system provider or covered
9 developer shall delete all information collected for the purposes of
10 this article after such purpose has been achieved, except where neces-
11 sary for compliance with applicable provisions of law or regulation.
12 2. All digital signals transmitted pursuant to sections fifteen
13 hundred forty-one and fifteen hundred forty-two of this article shall be
14 encrypted to ensure data integrity and security.
15 § 1545. Limitations. 1. Notwithstanding section fifteen hundred
16 forty-two of this article, a covered developer of a family account
17 application shall be permitted to rely upon the previously determined
18 age category of the primary account holder for the purposes of this
19 article. However, such covered developer shall allow such primary
20 account holder to report the age category of the user of any sub-account
21 or profile of such family account application.
22 2. This article shall not be construed to impose liability on any
23 operating system provider or covered developer that arises from the use
24 of an internet-enabled device, operating system, or software application
25 by a person who is not the user to whom an age category signal pertains,
26 provided that such operating system provider or covered developer is
27 otherwise in compliance with this article.
28 § 1546. Rulemaking authority. The attorney general may promulgate such
29 rules and regulations as are necessary to effectuate and enforce the
30 provisions of this article.
31 § 1547. Scope. This article shall apply to conduct that occurs in
32 whole or in part in New York. For purposes of this article, conduct
33 takes place wholly outside of New York when an internet-enabled device,
34 operating system, or software application is accessed by a user who is
35 physically located outside of New York.
36 § 1548. Enforcement. 1. Whenever it appears to the attorney general,
37 either upon complaint or otherwise, that any person, within or outside
38 the state, has engaged in or is about to engage in any of the acts or
39 practices stated to be unlawful in this article, the attorney general
40 may bring an action or special proceeding in the name and on behalf of
41 the people of the state of New York to enjoin any violation of this
42 article, to obtain restitution of any moneys or property obtained
43 directly or indirectly by any such violation, to obtain disgorgement of
44 any profits or gains obtained directly or indirectly by any such
45 violation, including but not limited to the destruction of unlawfully
46 obtained data, to obtain damages caused directly or indirectly by any
47 such violation, to obtain civil penalties of up to ten thousand dollars
48 per violation, and to obtain any such other and further relief as the
49 court may deem proper, including preliminary relief.
50 2. Nothing in this article shall be construed as providing the basis
51 for, or be subject to, a private right of action to violations of this
52 article or under any other law.
53 3. The attorney general shall maintain a website to receive
54 complaints, information, or referrals from members of the public
55 concerning alleged noncompliance with the provisions of this article.
S. 8102--B 4
1 § 2. Subdivision 1 of section 899-ii of the general business law, as
2 added by chapter 121 of the laws of 2024, is amended to read as follows:
3 1. For the purposes of this article, an operator shall treat a user as
4 a covered user if the user's device communicates or signals that the
5 user is or shall be treated as a minor, including through a browser
6 plug-in or privacy setting, device setting, or other mechanism that
7 complies with regulations promulgated by the attorney general, including
8 but not limited to the digital signals created in article forty-five-B
9 of this chapter.
10 § 3. If any clause, sentence, paragraph, subdivision, section or part
11 of this act shall be adjudged by any court of competent jurisdiction to
12 be invalid, such judgment shall not affect, impair, or invalidate the
13 remainder thereof, but shall be confined in its operation to the clause,
14 sentence, paragraph, subdivision, section or part thereof directly
15 involved in the controversy in which such judgment shall have been
16 rendered. It is hereby declared to be the intent of the legislature that
17 this act would have been enacted even if such invalid provisions had not
18 been included herein.
19 § 4. This act shall take effect one year after it shall have become a
20 law. Effective immediately, the addition, amendment and/or repeal of any
21 rule or regulation necessary for the implementation of this act on its
22 effective date are authorized to be made and completed on or before such
23 effective date.
