The New York Child Data Protection Act takes effect today, extending privacy protections for children and teenagers well beyond the under-13 limit set by the federal COPPA rule.
Key points
- Applies to operators of websites, apps and connected devices that know a user is a minor (under 18) or whose service is primarily directed to minors.
- Processing of minors’ personal data is limited to what is strictly necessary, unless informed consent has been obtained.
- Operators must recognise device or browser signals indicating a user is a minor.
- Third-party processors handling minors’ data must be bound by written agreements.
- The New York Attorney General can enforce the law, with civil penalties per violation.
UK organisations offering online services used by young people in New York need to review data collection, consent and age-signal handling. The law sits alongside the UK Children’s Code, so a single high-privacy approach for young users can often satisfy both.
Source: New York Child Data Protection Act implementation guidance (New York Attorney General)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
