Add Art 45-C ??1550 - 1558, amd ?899-ii, Gen Bus L
Requires manufacturers of internet-enabled devices to conduct age assurance to determine a user's age category and provide all websites, online services, online applications and mobile applications on such user's internet-enabled device and/or application store manufactured by the covered manufacturer with a digital signal that such user is a covered minor as well as the age category of such covered minor via a real-time application programming interface (API).
STATE OF NEW YORK
________________________________________________________________________
8102--C
2025-2026 Regular Sessions
IN SENATE
May 15, 2025
___________
Introduced by Sens. GOUNARDES, SUTTON -- read twice and ordered printed,
and when printed to be committed to the Committee on Consumer
Protection -- recommitted to the Committee on Consumer Protection in
accordance with Senate Rule 6, sec. 8 -- committee discharged, bill
amended, ordered reprinted as amended and recommitted to said commit-
tee -- committee discharged, bill amended, ordered reprinted as
amended and recommitted to said committee -- committee discharged,
bill amended, ordered reprinted as amended and recommitted to said
committee
AN ACT to amend the general business law, in relation to device-level
age assurance
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new article
2 45-C to read as follows:
3 ARTICLE 45-C
4 DEVICE-LEVEL AGE ASSURANCE
5 Section 1550. Definitions.
6 1551. Obligations for operating system providers.
7 1552. Obligations for covered developers.
8 1553. Nondiscrimination.
9 1554. Data security.
10 1555. Limitations.
11 1556. Rulemaking authority.
12 1557. Scope.
13 1558. Enforcement.
14 § 1550. Definitions. For the purposes of this article, the following
15 terms shall have the following meanings:
16 1. "Age assurance" shall mean a method to reasonably determine the age
17 category of a user that meets the requirements of article forty-five of
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD13065-19-6
S. 8102--C 2
1 this chapter and its implementing rules or regulations, or a method that
2 is identified pursuant to new regulations promulgated by the attorney
3 general consistent with section fifteen hundred fifty-six of this arti-
4 cle, provided, however, that for purposes of this article, an operating
5 system provider may not rely on self-declaration of age category for
6 users under the age of eighteen years to determine the age category of
7 such user. For the purposes of this article, declaration of an age
8 category for a user under the age of eighteen years may only be accepted
9 by an operating system provider if the user declaring such age has been
10 reasonably determined via a commercially reasonable and technically
11 feasible age assurance method that meets the requirements of article
12 forty-five of this chapter and its implementing rules or regulations, as
13 amended, or via a commercially reasonable and technically feasible age
14 assurance method which meets the requirements of new regulations that
15 have been promulgated by the attorney general pursuant to this article,
16 to be a user that is at least eighteen years of age and such user is
17 declaring that another user is under the age of eighteen years. A user
18 under the age of eighteen years, however, may not self-declare such
19 user's own age category.
20 2. "Age category" shall mean data that a user is (a) under the age of
21 thirteen years; (b) at least thirteen but under sixteen years; (c) at
22 least sixteen but under eighteen years; or (d) at least eighteen years.
23 3. "Application programming interface" or "API" shall mean a system
24 that allows two or more software systems to communicate and exchange
25 information, features, and functionality.
26 4. "Covered developer" shall mean a person who owns or controls a
27 software application that may run on an internet-enabled device and
28 which is accessed by a user in the state of New York.
29 5. "Covered minor" shall mean a user under the age of eighteen.
30 6. "Family account application" shall mean a software application that
31 uses a method of age assurance, as defined in subdivision one of this
32 section, to reasonably determine that the primary account holder of such
33 application is at least eighteen years of age, and which offers sub-ac-
34 counts or user profiles within such application.
35 7. "Internet-enabled device" shall mean and include any desktop,
36 laptop, smartphone, tablet, or other device capable of connecting to the
37 internet and enabling the user to access content on the internet.
38 8. "Operating system" shall mean the system software that manages the
39 hardware of an internet-enabled device and allows programs and applica-
40 tions to run on such device.
41 9. "Operating system provider" shall mean any person, partnership,
42 association, firm, business, or other legal entity, or any member there-
43 of, who develops, licenses, or controls an internet-enabled device's
44 operating system.
45 § 1551. Obligations for operating system providers. 1. Upon activation
46 of an internet-enabled device after the effective date of this article,
47 an operating system provider shall conduct age assurance, as defined in
48 subdivision one of section fifteen hundred fifty of this article, to
49 determine a user's age category at the point of such activation.
50 2. For devices that were activated prior to the effective date of this
51 article, such operating system provider shall conduct the age assurance
52 described herein within one hundred eighty days of such effective date.
53 3. An operating system provider shall provide a covered developer with
54 a digital signal indicating the age category of a user via a real-time,
55 reasonably consistent application programming interface (API) upon
56 receiving a request for such signal from such developer.
S. 8102--C 3
1 § 1552. Obligations for covered developers. 1. All covered developers
2 shall request an age category signal for a user from an operating system
3 provider at the point at which such user downloads and launches such
4 developer's application after the effective date of this article.
5 2. For all applications downloaded and launched prior to the effective
6 date of this article, covered developers shall request such age category
7 signal within one hundred eighty days of such effective date.
8 3. If the signal indicates that a user is a covered minor, then such
9 covered developer shall treat such signal as an authoritative indicator
10 of such user's age for the purposes of compliance with any applicable
11 law and the covered developer shall be deemed to have actual knowledge
12 that a user is a covered minor across all platforms and points of access
13 of the application, including where such minor accesses the application
14 via a website or browser; provided, however, that a covered developer
15 shall not willfully disregard reliable information otherwise available
16 to the covered developer that indicates a user's age is different than
17 that indicated by the age category signal provided by an operating
18 system provider.
19 § 1553. Nondiscrimination. 1. An operating system provider shall
20 impose at least the same restrictions and obligations on its own appli-
21 cations as it imposes on the applications of third parties.
22 2. An operating system provider shall not withhold, degrade, lower the
23 quality, or increase the price of any product, service, or feature to a
24 user due to the provisions of this article, other than as necessary for
25 compliance with the provisions of this article.
26 § 1554. Data security. 1. An operating system provider or covered
27 developer shall delete all information collected for the purposes of
28 this article after such purpose has been achieved, except where neces-
29 sary for compliance with applicable provisions of law or regulation.
30 2. All digital signals transmitted pursuant to sections fifteen
31 hundred fifty-one and fifteen hundred fifty-two of this article shall be
32 encrypted to ensure data integrity and security.
33 § 1555. Limitations. 1. Notwithstanding section fifteen hundred
34 fifty-two of this article, a covered developer of a family account
35 application shall be permitted to rely upon the previously determined
36 age category of the primary account holder for the purposes of this
37 article. However, such covered developer shall allow such primary
38 account holder to report the age category of the user of any sub-account
39 or profile of such family account application.
40 2. This article shall not be construed to impose liability on any
41 operating system provider or covered developer that arises from the use
42 of an internet-enabled device, operating system, or software application
43 by a person who is not the user to whom an age category signal pertains,
44 provided that such operating system provider or covered developer is
45 otherwise in compliance with this article.
46 § 1556. Rulemaking authority. The attorney general may promulgate such
47 rules and regulations as are necessary to effectuate and enforce the
48 provisions of this article.
49 § 1557. Scope. This article shall apply to conduct that occurs in
50 whole or in part in New York. For purposes of this article, conduct
51 takes place wholly outside of New York when an internet-enabled device,
52 operating system, or software application is accessed by a user who is
53 physically located outside of New York.
54 § 1558. Enforcement. 1. Whenever it appears to the attorney general,
55 either upon complaint or otherwise, that any person, within or outside
56 the state, has engaged in or is about to engage in any of the acts or
S. 8102--C 4
1 practices stated to be unlawful in this article, the attorney general
2 may bring an action or special proceeding in the name and on behalf of
3 the people of the state of New York to enjoin any violation of this
4 article, to obtain restitution of any moneys or property obtained
5 directly or indirectly by any such violation, to obtain disgorgement of
6 any profits or gains obtained directly or indirectly by any such
7 violation, including but not limited to the destruction of unlawfully
8 obtained data, to obtain damages caused directly or indirectly by any
9 such violation, to obtain civil penalties of up to ten thousand dollars
10 per violation, and to obtain any such other and further relief as the
11 court may deem proper, including preliminary relief.
12 2. Nothing in this article shall be construed as providing the basis
13 for, or be subject to, a private right of action to violations of this
14 article or under any other law.
15 3. The attorney general shall maintain a website to receive
16 complaints, information, or referrals from members of the public
17 concerning alleged noncompliance with the provisions of this article.
18 § 2. Subdivision 1 of section 899-ii of the general business law, as
19 added by chapter 121 of the laws of 2024, is amended to read as follows:
20 1. For the purposes of this article, an operator shall treat a user as
21 a covered user if the user's device communicates or signals that the
22 user is or shall be treated as a minor, including through a browser
23 plug-in or privacy setting, device setting, or other mechanism that
24 complies with regulations promulgated by the attorney general, including
25 but not limited to the digital signals created in article forty-five-C
26 of this chapter.
27 § 3. Severability clause. If any clause, sentence, paragraph, subdivi-
28 sion, section or part of this act shall be adjudged by any court of
29 competent jurisdiction to be invalid, such judgment shall not affect,
30 impair, or invalidate the remainder thereof, but shall be confined in
31 its operation to the clause, sentence, paragraph, subdivision, section
32 or part thereof directly involved in the controversy in which such judg-
33 ment shall have been rendered. It is hereby declared to be the intent of
34 the legislature that this act would have been enacted even if such
35 invalid provisions had not been included herein.
36 § 4. This act shall take effect one year after it shall have become a
37 law. Effective immediately, the addition, amendment and/or repeal of any
38 rule or regulation necessary for the implementation of this act on its
39 effective date are authorized to be made and completed on or before such
40 effective date.
