The New York Child Data Protection Act (S7695A of 2024) has been in effect since June 20, 2025, and restricts how online services process the personal data of users under 18, going well beyond COPPA’s under-13 scope.
How the New York Child Data Protection Act Limits Ad Targeting
Operators may only process a covered minor’s data when strictly necessary to provide the requested service or for a short list of permitted purposes, and the law expressly excludes marketing and advertising from those purposes. Processing for advertising requires informed consent, from a parent for users under 13 and from the teen themselves for users 13 to 17. Selling minors’ personal data is prohibited outright, and third parties receiving minors’ data must be bound by written agreements.
Enforcement and Campaign Defaults
The New York Attorney General enforces the act with injunctions, damages, and civil penalties up to $5,000 per violation. In practice, behavioral ad targeting, retargeting, and lookalike modeling using New York minors’ data are now opt-in only, so campaigns aimed at teens in New York should default to contextual placement.
Source: New York State Senate: S7695A (2024)
Report a violation: If you believe a business is violating this law, you can file a complaint with the New York Attorney General Consumer Frauds and Protection Bureau.
