Regulon — NY-S-04506 · NY S 4506 (SAFE for All Act)

Summary

Requires operators of addictive social media platforms — websites and apps that provide addictive feeds (algorithmically recommended content streams) as a significant part of their service — to offer users mechanisms to turn off algorithmic recommendations, turn off notifications (at minimum overall or between midnight and 6 AM Eastern), turn off autoplay, and set daily time limits. Prohibits dark patterns that subvert user choice or make it harder to exercise these settings or manage accounts. Enforced exclusively by the New York Attorney General, with civil penalties up to $5,000 per violation plus injunctive relief, restitution, disgorgement, and damages. Expressly preserves the separate SAFE for Kids Act (Article 45) and federal COPPA requirements.

Enforcement & Penalties

Enforcement Authority

Enforcement is exclusively by the Attorney General, who may bring an action or special proceeding upon complaint or otherwise. There is no private right of action. The Attorney General must maintain a public complaint website to receive reports of noncompliance. Enforcement may be initiated by the AG based on complaints received or on the AG's own initiative.

Penalties

Civil penalties of up to $5,000 per violation. The Attorney General may also obtain injunctive relief (including preliminary relief), restitution of moneys or property obtained by the violation, disgorgement of profits or gains obtained by the violation, and damages caused directly or indirectly by the violation.

Who Is Covered

"Operator" shall mean any person, business, or other legal entity, who operates or provides an addictive social media platform.

What Is Covered

"Addictive social media platform" shall mean a website, online service, online application, or mobile application, that offers or provides users with addictive feeds as a significant part of the provision of such website, online service, online application, or mobile application.

"Addictive feed" shall mean a regularly updated stream of algorithmic recommendations that a user encounters on a website, online service, online application, mobile application, or portion thereof.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

CP-01 Deceptive & Manipulative AI Conduct · CP-01.2 · Deployer · Social Media

Gen. Bus. Law § 1510(1)-(4)

Plain Language

Operators of addictive social media platforms must provide users with four distinct user-facing controls: (1) a mechanism to turn off algorithmic recommendations entirely; (2) a mechanism to turn off notifications related to the addictive feed — at minimum, the ability to disable all notifications or to disable them between midnight and 6 AM Eastern; (3) a mechanism to turn off autoplay; and (4) a mechanism to impose a daily time limit of any length the user chooses. A feature that merely reminds users of time spent (without actually restricting access) does not satisfy the time-limit requirement. The definition of 'algorithmic recommendation' contains extensive carve-outs: chronological feeds from subscribed sources, search results, direct messages, sequential content, accessibility settings, and recommendations needed for statutory compliance are all excluded. Failure to provide these mechanisms makes it unlawful to offer the platform to New York users at all.

Statutory Text

It shall be unlawful for an operator to provide an addictive social media platform to a user in this state unless such platform offers mechanisms through which a user may: 1. Turn off algorithmic recommendations; 2. Turn off notifications concerning an addictive feed, provided further that such mechanism shall, at a minimum, provide the user with the ability to turn off notifications overall or to turn off notifications between the hours of 12 AM Eastern and 6 AM Eastern; 3. Turn off autoplay on such platform; and 4. Limit such user's access to such platform to any length of day specified by such user, provided further that any mechanism which solely reminds such user of time spent on a platform rather than allowing such user to limit such user's access shall not be in compliance with this subdivision.

CP-01 Deceptive & Manipulative AI Conduct · CP-01.3 · Deployer · Social Media

Gen. Bus. Law § 1511(1)

Plain Language

The user controls required by § 1510 (algorithmic recommendation opt-out, notification controls, autoplay opt-out, and time limits) must be presented clearly and accessibly. Platforms may not use dark patterns or any design mechanism that intentionally undermines the purpose of the law, subverts user choice or autonomy, or makes it harder for users to access or exercise these settings. This is an intent-based prohibition — enforcement requires showing the mechanism was deployed 'intentionally' to inhibit user rights, though the bar for what constitutes an intentional impediment will likely be fleshed out through AG rulemaking.

Statutory Text

The settings required in section fifteen hundred ten of this article shall be presented in a clear and accessible manner on an addictive social media platform. It shall be unlawful for such platform to deploy any mechanism or design which intentionally inhibits the purpose of this article, subverts user choice or autonomy, or makes it more difficult for a user to exercise their rights under any of the prescribed settings in section fifteen hundred ten of this article.

CP-01 Deceptive & Manipulative AI Conduct · CP-01.3 · Deployer · Social Media

Gen. Bus. Law § 1511(2)

Plain Language

Platforms may not use dark patterns or any intentional design mechanism that makes it harder for a user to deactivate, reactivate, suspend, or cancel their account or profile. This extends the dark-patterns prohibition beyond the § 1510 settings to cover core account management actions. Like § 1511(1), this requires intentional deployment of an impediment — accidental poor UX design without intent to impede would presumably not violate this provision.

Statutory Text

It shall be unlawful for an addictive social media platform to deploy any mechanism or design which intentionally serves to make it more difficult for a user to deactivate, reactivate, suspend, or cancel such user's account or profile.

Other · Social Media

Gen. Bus. Law § 1512

Plain Language

This provision clarifies that the SAFE for All Act does not displace, override, or conflict with the separate SAFE for Kids Act (Article 45 of the General Business Law). Both sets of obligations apply independently. This is a savings clause and creates no new compliance obligation.

Statutory Text

Nothing in this article shall be construed or interpreted to override, supplant, or conflict with any of the provisions of the SAFE for kids act contained in article forty-five of this chapter.

Other · Social Media

Gen. Bus. Law § 1514

Plain Language

The Attorney General is directed to promulgate rules and regulations to implement and enforce the SAFE for All Act. This is an enabling provision for the AG — not a direct compliance obligation on operators. However, the law's effective date is keyed to 180 days after the AG promulgates these rules, so operators should monitor AG rulemaking activity closely.

Statutory Text

The attorney general shall promulgate rules and regulations to effectuate and enforce the provisions of this article.

Other · Social Media

Gen. Bus. Law § 1515(1)-(2)

Plain Language

This provision establishes the Attorney General as the sole enforcement authority for the SAFE for All Act. The AG may bring enforcement actions upon complaint or on its own initiative, seeking injunctions, restitution, disgorgement, damages, and civil penalties up to $5,000 per violation. The AG must also maintain a public complaint website. This creates no direct compliance obligation on operators — it is the enforcement framework. The available remedies and enforcement mechanism are captured in the law-level enforcement_authority and damages fields.

Statutory Text

1. On or after the effective date of this article, whenever it appears to the attorney general, upon complaint or otherwise, that any person, within or outside the state, has violated the provisions of this article, the attorney general may bring an action or special proceeding in the name and on behalf of the people of the state of New York to enjoin any such violation, to obtain restitution of any moneys or property obtained directly or indirectly by any such violation, to obtain disgorgement of any profits or gains obtained directly or indirectly by any such violation, to obtain damages caused directly or indirectly by any such violation, to obtain civil penalties of up to five thousand dollars per violation, and to obtain any such other and further relief as the court may deem proper, including preliminary relief. 2. The attorney general shall maintain a website to receive complaints, information, and/or referrals from members of the public concerning an operator's or addictive social media platform's alleged compliance or noncompliance with the provisions of this article.

Other · Social Media

Gen. Bus. Law § 1513(1)-(2)

Plain Language

The law applies to conduct occurring in whole or in part in New York. Conduct is deemed outside New York only if the user is physically located outside the state. The COPPA savings clause provides that the law will not impose liability inconsistent with federal COPPA treatment of the same commercial activities. This creates no new compliance obligation — it sets jurisdictional boundaries and preserves federal preemption for COPPA-regulated activities.

Statutory Text

1. This article shall apply to conduct that occurs in whole or in part in New York. For purposes of this article, conduct takes place wholly outside of New York if the addictive social media platform is accessed by a user who is physically located outside of New York. 2. Nothing in this article shall be construed to impose liability for commercial activities or actions by operators subject to 15 USC § 6501 that is inconsistent with the treatment of such activities or actions under 15 USC § 6502.