New York Attorney General Letitia James released final rules implementing the SAFE for Kids Act, which requires social media companies to restrict algorithmically personalized feeds and nighttime notifications for users under 18 unless they obtain parental consent. The rules establish age assurance standards, parental consent procedures, and data minimization requirements, with civil penalties of up to $5,000 per violation for noncompliance.
Social media companies must implement age assurance methods meeting accuracy benchmarks, offer at least one alternative to government ID, delete or de-identify age data immediately after use, and conduct annual testing with results retained for 10 years. Parental consent must be obtained for addictive feeds and nighttime notifications, and minors can withdraw consent at any time. The OAG may seek civil penalties up to $5,000 per violation and injunctive relief.
In-house legal teams should review their platform terms of service, privacy policies, and data processing agreements to ensure compliance with the SAFE for Kids Act. Key clauses to update include age verification mechanisms, parental consent workflows, data minimization and deletion obligations for age assurance data, and restrictions on algorithmic feeds and nighttime notifications for minors. Vendor agreements with age verification service providers should include accuracy benchmarks, annual testing requirements, and data protection provisions. Customer-facing agreements (terms of service) must clearly explain how minors can opt out of addictive feeds and how parents can grant or withdraw consent.
Entity
New York State Office of the Attorney General
Industry
Social MediaOfficial Press Release
https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules
safe for kids act final rule
https://ag.ny.gov/safe-for-kids-act-final-rule
safe for kids act nprm
https://ag.ny.gov/sites/default/files/regulatory-documents/safe-for-kids-act-nprm.pdf
protecting children online
https://ag.ny.gov/resources/individuals/consumer-issues/technology/protecting-children-online
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"New York Attorney General Letitia James"
"civil penalties of up to $5,000 per violation"
"SAFE for Kids Act"
"New York Child Data Protection Act"
"restrict algorithmically personalized feeds and nighttime notifications for users under the age of 18 unless they obtain parental consent"
$352K
New York Attorney General Letitia James settled with Brooklyn High Rise LLC for illegally denying housing to prospective tenants based on housing court records, a practice known as tenant blacklisting. The company also charged non-refundable 'good faith' deposits. Brooklyn High Rise will pay $352,250 in penalties and restitution and must end its unlawful tenant screening practices.
New York Attorney General Letitia James issued an industry alert urging workers with knowledge of unsafe or illegal conduct in AI development to file confidential complaints through the OAG's secure whistleblower portal. The alert cites the OAG's monitoring of cybersecurity, economic, and other safety risks from emerging AI, and highlights the RAISE Act (effective January 1, 2027), which will require large AI developers to publicly disclose safety measures and report security incidents, as well as the SHIELD Act's data security requirements. No company was named, charged, or penalized; the alert signals impending OAG enforcement authority over AI developers.
$700.0M
New York Attorney General Letitia James, leading a bipartisan coalition of 39 other states, the District of Columbia, and Hawaii's Office of Consumer Protection, secured a $700 million settlement from Credit Acceptance Corporation (CAC), a subprime auto lender, resolving allegations of deceptive and abusive lending. The lawsuit alleged CAC pushed tens of thousands of consumers into unaffordable loans with average interest rates above 38 percent, bundled with expensive add-on products consumers were told were mandatory or never told about, causing widespread defaults and vehicle repossessions. Note: this is a consumer-lending enforcement action rather than a privacy matter, so no privacy violation categories from the taxonomy apply.
$700K
New York Attorney General Letitia James secured a settlement with two Mt. Kisco car dealerships, DARCARS Lexus and DARCARS BMW, that deceptively charged a two percent 'sales commission' fee that was optional, provided no consumer benefit, and was never paid to the salesperson, and that misleadingly bundled a low-value aftermarket product ('DARCARS Assurance') into sales and lease agreements as if it were mandatory. The dealerships will pay more than $1.17 million in consumer refunds (with potentially millions more through a claims process) plus $700,000 in penalties. They must clearly disclose all future fees and add-ons, are banned from selling DARCARS Assurance or similar junk bundles at any New York dealership, and must conduct annual fair-business-practices training for all employees.
New York Attorney General Letitia James led a bipartisan coalition of 17 other state attorneys general in sending a letter to Congress opposing the Digital Asset Market Clarity Act, warning that the bill would preempt state attorneys general authority to combat cryptocurrency fraud and scams. This is a legislative advocacy action, not an enforcement action against any company, and no penalties or remedies were imposed. The coalition urged Congress to preserve state enforcement power over both tokenized and non-tokenized securities and state crypto registration regimes.
$8.0M
New York Attorney General Letitia James secured an $8 million settlement from VGW Holdings Pty. Ltd. and its affiliates for unlawfully operating online sweepstakes casinos — Chumba Casino, Global Poker, and Luckyland Slots — that allowed New Yorkers to play casino games with virtual coins exchangeable for cash or prizes. The OAG's June 2025 cease and desist letter stopped the company from offering virtual coin gambling in New York, and Governor Hochul signed a formal ban on sweepstakes casinos into law in December 2025. Under the settlement, VGW will pay $8 million in disgorgement, penalties, and costs; note this is an illegal-gambling enforcement action rather than a privacy matter, so no privacy violation taxonomy categories apply.