New York's under-18 social media ban is included in the state budget that was signed by the Governor two weeks ago.

What they're not telling you: New York Embeds Warrantless Age-Verification Surveillance into State Budget Without Public Debate Governor Kathy Hochul signed legislation two weeks ago that mandates social media platforms operating in New York implement age-verification systems capable of collecting and storing biometric and identity data on minors, buried inside the state's $237 billion budget as the "Safe By Design Act"—a renamed version of the Children's Online Safety Act that was repackaged into Senate Bill 9008 to avoid floor debate. The legislation, now codified in New York penal law, requires platforms to implement "age-appropriate design" standards and age verification mechanisms, but contains no explicit prohibition on data retention, third-party sharing, or the specific verification methods platforms must deploy. The bill's language mandates compliance with undefined "industry standards" for age verification—a critical gap that leaves implementation details to platforms themselves and to future regulatory guidance that has not yet been written.

What the Documents Show

The mechanism is straightforward: platforms must verify users under 18 before account creation or continued access. This requires collection of government-issued identification, biometric facial recognition data, or third-party age verification services that broker identity information. None of these collection points are restricted by the statute. A platform could legally use a third-party verification vendor—companies like Yoti, Age Check ID, or Intellinetics—that stores full identity documents, facial scans, and cross-references them against data brokers. The bill imposes no data minimization requirements and no mandatory deletion timelines.

Follow the Money

What makes this significant is the mechanism's invisibility within budget legislation. The Children's Online Safety Act failed in committee debate last year when privacy advocates and civil liberties organizations highlighted the age-verification surveillance infrastructure it would create. Instead of returning it to committee or amending it through public process, legislators merged it into Senate Bill 9008—the state's annual budget bill—where it received no separate floor debate and was voted on as part of a larger appropriations package. The bill's drafters included language requiring platforms to conduct "impact assessments" on minors' privacy, but these assessments are exempt from public disclosure under existing FOIL (Freedom of Information Law) exemptions for trade secrets. Platforms will document how their age verification systems impact user privacy—and those documents will not be accessible to New York residents or independent researchers. Governor Hochul's office did not issue a public statement specifically about the age-verification provisions.

What Else We Know

Her signing memo, released as part of routine budget documentation, does not mention the Safe By Design Act or its surveillance infrastructure implications. The legislation became law without a gubernatorial statement of intent or public acknowledgment of what it actually requires. The immediate effect: every social media platform operating in New York must begin collecting identity verification data from users under 18 within 90 days of the budget passage. The secondary effect—the one the legislative process obscured—is the creation of a de facto identity database of minors, stored not by government, but by third-party vendors with minimal oversight and no legal obligation to delete data once age verification is complete. --- THE TAKE --- What strikes me about this pattern is how thoroughly it inverts the stated purpose. The bill is marketed as protecting children from algorithmic harms, but its actual mechanism is the most extensive identity-collection infrastructure for minors that New York has created outside of education records.

Primary Sources

• Source: r/privacy
• Category: Surveillance State
• Cross-reference independently — don't take our word for it.

Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.