What does New York's Child Data Protection Act mean for ad supported sites?
Part of US and Canada targeting
The short answer
New York's Child Data Protection Act took effect June 20, 2025. It bars operators from processing personal data of covered users, people under 18 known to be minors or using services primarily directed to minors, unless the processing is strictly necessary for a listed purpose or the user gives informed consent. Advertising is not among the strictly necessary purposes.
Key takeaways
- The act is codified at General Business Law sections 899-ee and following, effective June 20, 2025 per the Attorney General's guidance.
- A covered user is a New York user known by the operator to be under 18, or using a service, or a portion of one, primarily directed to minors.
- For users 13 to 17, processing without consent must be strictly necessary for a listed purpose; internal business operations exclude marketing and advertising.
- Operators may not buy or sell a covered user's personal data, and must respect device signals that a user is a minor.
- The Attorney General enforces the act and may seek civil penalties up to $5,000 per violation, plus restitution, disgorgement and damages.
What does New York's Child Data Protection Act require?
The core rule is in section 899-ff (opens in a new tab) of the General Business Law. An operator may not process a covered user's personal data, or let a processor or third-party operator collect it, unless one of two routes applies. For a user 12 or younger, processing must be permitted under the federal Children's Online Privacy Protection Act. For a user 13 or older, processing must be strictly necessary for a purpose in subdivision 2, or the operator must have the user's informed consent.
| Section | Duty | Who it binds |
|---|---|---|
| 899-ff(1) | No processing of a covered user's personal data except under COPPA (12 and under) or the strictly necessary or consent routes (13 and over) | Operators, and the processors and third-party operators they allow to collect |
| 899-ff(3) | Consent requests must be separate, say the processing is not strictly necessary, and make refusal the most prominent option | Operators asking for informed consent |
| 899-ff(5) | No buying or selling of a covered user's personal data, except as section 899-jj provides | Operators, processors and third-party operators |
| 899-ff(7) | Disclose to a third-party operator when the service is primarily directed to minors or the data concerns a covered user | Operators sharing with or admitting third-party operators |
| 899-gg | A written, binding agreement before a processor handles covered users' data | Operators and processors |
| 899-ii | Treat a user as a minor when the device signals it, and follow clear consent or refusal signals | Operators |
The act reaches personal data broadly. The definitions in section 899-ee (opens in a new tab) cover data that identifies or could reasonably be linked, directly or indirectly, with a natural person or device, so an identifier tied to a browser or phone is within it.
Who counts as a minor under the New York act?
Definition
- Covered user (General Business Law 899-ee)
- A user in New York of a website, online service, online application, mobile application or connected device who is actually known by the operator to be a minor, or who is using a service, or a portion of one, primarily directed to minors. A minor is a natural person under eighteen.
The two routes into coverage are alternatives. One rests on the operator's actual knowledge of a user's age; the other on the audience the service, or a portion of it, is aimed at. A link to a site directed to minors does not by itself make a service primarily directed to minors.
If the user is a minor, the operator has actual knowledge that the user is a covered user anywhere the operator can recognize the user’s account, including when the user logs into the same service or product using different devices or accesses different services or products using the same log-in credentials, and must comply with the law accordingly.
For teens, the Attorney General's guidance says the requirements apply only to services, or portions of them, that can be delineated as primarily directed or targeted to minors, a standard with some additional flexibility compared with COPPA's directed to children test. A teen section of a general site can be a covered portion on its own.
When did New York's Child Data Protection Act take effect?
The Attorney General's implementation guidance (opens in a new tab), last updated May 19, 2025, was issued ahead of the June 20, 2025 effective date. The Attorney General intends to issue rules on some terms and, until they are final, will exercise enforcement discretion and weigh an operator's good faith efforts to comply.
Enforcement sits in section 899-mm (opens in a new tab). The Attorney General may bring an action in the name of the people of New York against any person inside or outside the state, seek an injunction, restitution, disgorgement of profits including the destruction of unlawfully obtained data, damages, and civil penalties up to $5,000 per violation. Section 899-ll limits the article to conduct in whole or in part in New York.
How does the act affect ad supported websites?
Subdivision 2 of section 899-ff lists the purposes for which processing a 13 to 17 year old's data can be strictly necessary without consent: a requested product or service, internal business operations, technical errors, malicious, fraudulent or illegal activity, legal claims, legal compliance, government inquiries, security incidents and vital interests. The internal operations purpose excludes advertising directly.
internal business operations shall not include any activities related to marketing, advertising, research and development, [or] providing products or services to third parties.
| Processing | What the text says | Source |
|---|---|---|
| Behavioral advertising or profiling for ads | An operator may not get around the rule by marketing its core service as one that tracks users to support behavioral advertising | Attorney General guidance |
| Frequency capping | Allowed as protection against fraud under the malicious, fraudulent or illegal activity purpose | Attorney General guidance, 899-ff(2)(d) |
| Selling personal data to a partner | Prohibited, except as section 899-jj provides | 899-ff(5) |
| Letting an ad partner collect data | Allowed only on the COPPA, strictly necessary or consent routes, with disclosure that the data concerns a covered user | 899-ff(1) and (7) |
| Asking for consent to ad processing | Separate request, refusal as the most prominent option, no new request for the next calendar year after a refusal | 899-ff(3) |
Ad partners have their own position. Under section 899-jj (opens in a new tab) the limits in sections 899-ff and 899-gg do not apply to a third-party operator handling covered users' data from another service if it received reasonable written representations of informed consent, or has no actual knowledge that the user is a minor or that the service is primarily directed to minors. The 899-ff(7) disclosure supplies that knowledge.
Steps a publisher can document for a teen section
- Map the portions. List the sections, apps or features that can be delineated as primarily directed to minors, and the rest of the site.
- List each party that collects. Record each ad tag, exchange, measurement script and analytics library that loads on those portions.
- Assign a route. For each processing purpose, record whether it rests on COPPA, a strictly necessary purpose or informed consent.
- Send the disclosure. Record how third-party operators are told the portion is primarily directed to minors.
- Handle signals. Record how device age flags and consent or refusal signals are read and stored.
How is the New York act different from COPPA?
COPPA, in the FTC's words (opens in a new tab), applies to operators of websites or online services directed to children under 13, and to operators of other sites or services that have actual knowledge they are collecting personal information online from a child under 13. New York adopts COPPA for users 12 and under and adds its own rules for 13 to 17. The federal rule itself is covered on the COPPA programmatic advertising page.
| Point | COPPA (FTC) | New York Child Data Protection Act |
|---|---|---|
| Ages covered | Children under 13 | Minors under 18; COPPA governs those 12 and under |
| How a user is covered | Service directed to children, or actual knowledge of collection from a child | User actually known to be a minor, or using a service or portion primarily directed to minors |
| Who consents | A parent, through verifiable parental consent | For 13 to 17, the user, through informed consent or a device signal |
| Without consent | Listed exceptions in the rule | Processing strictly necessary for nine listed purposes, with advertising excluded from internal operations |
| Enforcer | Federal Trade Commission | New York Attorney General, up to $5,000 per violation |
Section 899-ll(3) says nothing in the article imposes liability on operators subject to COPPA for activities treated inconsistently with COPPA's own treatment of them. Canada's federal regulator takes another approach: the Office of the Privacy Commissioner (opens in a new tab) says that, as a best practice, organizations should avoid tracking children and tracking on websites aimed at children.
What does the act look like for a publisher outside New York?
Fictional example. Unnamed publisher, no results implied.
An Ohio video game guide site with a teen section
An unnamed publisher in Columbus, Ohio runs an ad supported site of video game walkthroughs and patch notes, with a separate section of beginner guides written for middle and high school players. Readers include users in New York. The publisher asks its ad operations lead what the New York act changes.
The lead marks the teen section as a portion that may be primarily directed to minors and the rest as general interest. On the teen section she lists each tag that loads, drops the audience segment and retargeting partners, keeps frequency capping under the fraud purpose, and records the disclosure sent to remaining third-party operators. On the general section she records how accounts with a stated age under 18 are handled.
How can PlacementGraph help an advertiser plan beside teen content?
PlacementGraph builds site lists from content, choosing where ads appear.
Frequently asked questions
Does the New York act apply when a covered user travels outside the state?
Section 899-ll covers conduct in whole or in part in New York. Commercial conduct is wholly outside the state when the data was collected while the user was elsewhere and no data about the user, or collected while the user was in New York, is used in the state.
What happens when a covered user turns 18?
Section 899-hh says that when an operator learns a user is no longer a covered user, it must stop processing that user's data covered by the article until it obtains informed consent under section 899-ff(3), and must tell the user they are no longer covered by the article's protections and rights.
Can an operator ask a teen again after a refusal?
Section 899-ff(3) says that if a covered user declines or revokes consent, the operator may not make another request for that processing for the following calendar year. If the device signals refusal, the operator may not ask at all, though it may offer a consent option the user starts.
Does the act change how schools share student data?
The Attorney General says the act does not disrupt the framework for student data under New York Education Law section 2-d and the federal FERPA. Data that is not personally identifiable student information, or is not collected for an educational purpose, falls under the act's own rules.
Sources
- New York Child Data Protection Act implementation guidance (updated May 19, 2025) (opens in a new tab)New York Office of the Attorney General
- General Business Law 899-EE (opens in a new tab)New York State Senate, Open Legislation
- General Business Law 899-FF (opens in a new tab)New York State Senate, Open Legislation
- General Business Law 899-II, Respecting user-provided age flags (opens in a new tab)New York State Senate, Open Legislation
- General Business Law 899-JJ, Protections for third-party operators (opens in a new tab)New York State Senate, Open Legislation
- General Business Law 899-LL, Scope (opens in a new tab)New York State Senate, Open Legislation
- General Business Law 899-MM, Remedies (opens in a new tab)New York State Senate, Open Legislation
- Children's Online Privacy Protection Rule (COPPA) (opens in a new tab)Federal Trade Commission
- Guidelines on privacy and online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.