EPIC Urges NY Attorney General To Center Data Minimization and Age Determination Best Practices in Rulemaking for NY SAFE for Kids Act

Yesterday EPIC submitted comments with the Center for Digital Democracy urging the New York Attorney General to center privacy and age determination best practices in its rulemaking to implement the New York SAFE for Kids Act. The NY SAFE for Kids Act prohibits social media platforms from providing “addictive feeds” and nighttime push notifications to minors without parental consent. As it is defined in the law, an addictive feed uses certain categories of users’ personal information to select and order content on their feeds. The law directs the Attorney General to promulgate regulations for how covered entities providing addictive feeds or nighttime push notifications should determine whether a user is a minor.

While the NY Safe for Kids Act does not regulate speech, EPIC encouraged the NY Attorney General to craft regulations anticipating a First Amendment challenge in line with the trend of Big Tech interests similarly challenging a broad swath of other kids’ online privacy and safety laws. The Attorney General should make clear that age determination does not need to be implemented as a condition for accessing regulated platforms. There is no need for age determination at all if a covered operator applies the Act’s protections to all users by eliminating addictive feeds and nighttime push notifications. The regulations can also incentivize covered operators to minimize the need for, or frequency of, age determination processes by turning addictive feeds and nighttime push notifications off by default for all users and only determining age if a user wishes to turn on the features. This would ensure that any user’s concerns about the age determination process would not cause a user to forego accessing the website altogether.

EPIC also recommended best practices for age determination. First, the Attorney General should encourage covered operators to use low- and no-friction age determination methods and prioritize data minimization principles. Second, EPIC urged the Attorney General to bolster trust in the age determination process by requiring covered operators and third-party vendors to periodically complete and publish data protection impact assessments. Through these requirements, and by setting up explicit processes to evaluate new age determination methods, the Attorney General should incentivize the development of even more privacy-protective age determination tools in the future.

EPIC also joined the comments filed by Common Sense Media in response to the rulemaking under the New York Child Data Protection Act. Among other important recommendations, the comments suggested that regulations consider  “strictly necessary” permissible processing to be limited to what is essential for a site to function. Additionally, the Attorney General to interpret “sale” expansively to appropriately cover “the sharing of personal data for behavioral advertising or sharing of personal data into the commercial data broker ecosystem, whether or not monetary or other valuable consideration is exchanged at the time.”

EPIC regularly engages with courts and regulators about platform governance, age assurance, and kids’ privacy and safety online. Last week, EPIC filed an amicus brief in the U.S. Supreme Court in Free Speech Coalition v. Paxton, providing a framework for the Court to consider laws that involve age assurance and urging the Court to issue fact- and statute-specific analysis explaining precisely why the Texas law at issue may be unconstitutional. EPIC also submitted an amicus brief to the Ninth Circuit in NetChoice v. Bonta supporting the California Age-Appropriate Design Code and comments to the Federal Trade Commission supporting changes to modernize the COPPA Rule.