BILL NUMBER: S8102B
SPONSOR: GOUNARDES
 
TITLE OF BILL:
An act to amend the general business law, in relation to device-level
age assurance
 
PURPOSE OR GENERAL IDEA OF BILL:
To require operating systems to conduct commercially reasonable age
assurance for users at the point of device activation, unlocking the
ability to enforce all other digital privacy and safety laws for under-
age users
 
SUMMARY OF PROVISIONS:
Section one of this bill creates a new Article 45-B to the General Busi-
ness Law (GBL) to require all operating system providers of Internet-en-
abled devices to conduct commercially reasonable and technically feasi-
ble age assurance for users at the point of device activation.
Operating system (OS) providers would need to adopt an assurance method
previously identified by the Office of the Attorney General (OAG) under
the regulations for the SAFE for Kids Act in Article 45 of GBL, or a
method identified under new regulations promulgated by the OAG if they
believe that updated regulations for this law are necessary. As the SAFE
for Kids regulations currently allow for self-reporting of age for all
users under the age of 18, this means minors would only need to self-at-
test to their age or minor status under the bill. For adults, the SAFE
for Kids regulations require an age assurance method method that is
somewhat more robust and meets the accuracy minimums prescribed in the
regulations which attempt to prevent method circumvention. This means
that adults, for example, might be able to prove age status by linking a
method of payment like a credit card to their device - as most adult
users already do today.
OS providers would be required to delete information collected for the
purposes of age assurance immediately after determining the user's age
and would not be able to favor their own apps over those of third
parties by imposing additional restrictions or conditions on the latter.
Applications (apps) would then be required to request the age signal
from the OS at the point of app download and launch by a user. The age
signal would be communicated to the app via a real-time application
programming interface (API) and would be encrypted. The age signal would
communicate whether a user is under the age of 13, between 13 and 15
years old, between 16 and 17 years old, or at least 18 years old and a
legal adult.
Apps would be able to treat the API signal as an authoritative indicator
of a user's age, but they would not be able to willfully disregard other
clear and convincing evidence available to an app developer that
conflicts with the API signal.
This bill clarifies that there would be no liability imposed upon an OS
provider or app developer that arises from the use of a device by a user
that is not the user to whom an age category signal pertains, however,
as there will naturally be some amount of device sharing in any house-
hold. Furthermore, family account applications such as streaming
services would be allowed to rely on the previously determined age cate-
gory of the primary account holder (i.e. parent) in the case of
conflicting signals.
This act would be enforced by the Attorney General, who may pursue a
civil penalty of $10,000 per violation, and would apply when users
access a device or operating system within the state of New York.
Section two of this bill makes a conforming edit to the New York Child
Data Protection Act in GBL Article 39-FF, which already requires online
operators under that law to treat a user as a minor if their device
signals as much
Section three of this bill sets a severability clause.
Section four of this bill creates the effective date.
 
JUSTIFICATION:
Concerns about digital well-being for underage users have grown exponen-
tially in recent years, with a 2020 Pew Research survey showing that 81%
of parents were worried about how much information advertisers could
glean about their child's behavior, and 72% of parents worried about
children's interaction with strangers online (Hogg, Luke, and Evan
Swarztrauber. On the Internet, No One Knows You're a Dog Examining the
Feasibility of Privacy- Preserving Age Verification Online. 2025.). A
2023 Mott Children's Hospital poll showed that overuse of devices,
social media, and Internet safety were the top three concerns for
parents, and American teens are currently spending the equivalent of a
40-hour workweek, or 8.5 hours a day, on social media, gaming, and
messaging and texting apps alone (Rosenberg, David. "Teens Are Spending
the Equivalent of a 40-Hour Work Week on Their Devices. Here's How to
Help Them Find the Right Balance." Fortune Well, 24 Oct. 2023,
fortune.com/wel1/2023/10/24/teens-too-much-screen-time-find-balance/)
States and nations have passed a laundry list of laws in recent years
endeavoring to protect minors online, such as those restricting access
to mobile sports betting or laws requiring apps to curb particularly
dangerous or addictive features for users under the age of 18. All of
these efforts are contingent, however, upon the deployer of the app or
product being able to reasonably ascertain the age of the user, so that
they know whether or not they should be treated as a minor under the
law.
This is why, over the last few years, at least 19 US states have imple-
mented age assurance mandates, along with several European countries,
where implementation of such laws has already begun (Hogg, Luke, and
Evan Swarztrauber. On the Internet, No One Knows You're a Dog Examining
the Feasibility of Privacy- Preserving Age Verification Online. 2025).
Age assurance is already the law of the land for social media apps with
algorithmic feeds under Article 45 of GBL, the Stop Addictive Feeds
Exploitation (SAFE) for Kids Act, in New York State.
Assumptions that the only way to identify the age of a user online is by
requiring a government ID are outdated, as many other methods of age
assurance have developed since the early days of the Internet. While
opponents of age assurance claim that there is no method to ascertain a
user's age that does not compromise security and privacy, this argument
ignores the advancement of zero-knowledge proof methods in recent years,
which allow a user to verify one fact about themself without giving up
any other personally identifying information (P11) (Hogg, Luke, and Evan
Swarztrauber. On the Internet, No One Knows You're a Dog Examining the
Feasibility of Privacy- Preserving Age Verification Online. 2025.).
Device-based storage systems, such as a digital wallet that enables a
user to store identity credentials to verify age, can be locally stored
on a device, encrypted, and used to provide data to a third party with-
out disclosing any other P11, minimizing the risk of exposure as the age
verification cannot be tied to broader online activity to create a
profile (Hogg, Luke, and Evan Swarztrauber. On the Internet, No One
Knows You're a Dog Examining the Feasibility of Privacy- Preserving Age
Verification Online. 2025.).
Similarly, double-blind systems, where the receiving platform does not
receive any information about the user and the age data provider does
not receive any information about the platform, minimize the sharing of
PI I while also reducing the risk of identity theft and data breaches.
Double-blind systems are so successful in preserving and advancing user
privacy, in fact, that Arcom, the French administrative agency in charge
of enforcing their age assurance law for mature adult websites, has
already mandated that the providers of such websites offer at least one
double-blind option to users (Hogg, Luke, and Evan Swarztrauber. On the
Internet, No One Knows You're a Dog Examining the Feasibility of Priva-
cy- Preserving Age Verification Online. 2025.). Where PII is involved,
it is not necessarily newly collected: some companies conducting age
assurance use existing digital information such as email addresses,
phone numbers, or public banking information to estimate age with
remarkable accuracy, and many laws require that PII, where collected for
age assurance, be encrypted and deleted once a company has used it to
estimate a user's age.
This bill would require that operating system providers on a device
conduct commercially reasonable age assurance at the point of device
activation pursuant to an acceptable age assurance method identified in
the SAFE for Kids regulations. For minors, this means they would only
need to self-attest to being a minor. For adults, this might look some-
thing like linking a credit card to their device - a popular and low
burden age assurance method that many users already do today.
The OS provider would then communicate if a user is a minor to apps and
services on the device, so that such services may be in compliance with
laws and regulations protecting kids online. While not the only effec-
tive means of conducting age assurance, as many sophisticated apps are
also capable of (and indeed already know) their users' ages, requiring
age assurance at the operating system level is one of the most effective
solutions as it streamlines compliance by embedding the information on
the device itself (Hogg, Luke, and Evan Swarztrauber. On the Internet,
No One Knows You're a Dog Examining the Feasibility of Privacy- Preserv-
ing Age Verification Online. 2025.). This means that individual websites
or apps would not need to conduct age assurance anew, if they are
already receiving this signal from the device, burdening only the hand-
ful of well-capitalized companies that are sophisticated and wealthy
enough to implement age assurance effectively. Microsoft Windows holds a
nearly 70% market share in the US for desktop operating systems, for
example, followed by Apple's macOS at 20% (Hogg, Luke, and Evan Swarz-
trauber. On the Internet, No One Knows You're a Dog Examining the Feasi-
bility of Privacy- Preserving Age Verification On line. 2025.). When it
comes to smartphones, Apple and Google combine for over 99% of market
share - Apple with 55% and Google with 45% (Hogg, Luke, and Evan Swarz-
trauber. On the Internet, No One Knows You're a Dog Examining the Feasi-
bility of Privacy- Preserving Age Verification Online. 2025.). Addi-
tionally, implementing age assurance at the device level would ensure
that users would only need to verify their age once, reducing friction
in the online experience.
By requiring some of the best-resourced tech companies to conduct age
assurance on their devices, using data they already already collect, and
then to communicate when a user is minor to other apps and services,
this bill holds tech actors to their existing legal obligations to
protect kids online. This singular age data point, which can be
encrypted, decoupled from any other identifying information, communi-
cated via a token or credential, and then deleted, unlocks the ability
for policymakers and regulators to enforce all other children's privacy
laws, as the apps would no longer be able to claim that they don't know
when a user is a minor. In the absence of effective age assurance, apps
can treat minors like adults, exposing them to the same predatory data
collection, behavioral tracking, and targeted advertising as any other
user (Hogg, Luke, and Evan Swarztrauber. On the Internet, No One Knows
You're a Dog Examining the Feasibility of Privacy- Preserving Age
Verification Online. 2025.). This bill would leverage advances in modern
technology to close this egregious loophole, finally giving teeth to New
York and other jurisdictions' many valiant efforts to protect children
online and boost digital well-being.
 
PRIOR LEGISLATIVE HISTORY:
2025: Referred to Consumer Protection
 
FISCAL IMPLICATIONS:
None
 
EFFECTIVE DATE:
This act shall take effect one year after it shall have become a law.

Statutes affected:
S8102A: 899-ii general business law, 899-ii(1) general business law
S8102B: 899-ii general business law, 899-ii(1) general business law