Jason Oliveri Discusses the New York Child Data Protection Act Going into Effect

Via Privacy Daily

June 30, 2025

Hinshaw partner Jason Oliveri was extensively quoted in a recent Privacy Daily article discussing the unique nature and significance of the New York Child Data Protection Act. The law—which went into effect on June 20, 2025—makes New York the first state to provide "heightened protections" for youth or minors regarding their privacy and data protection.

Importance of Child Privacy Protection Laws

Jason noted the law will likely face legal challenges, but added that protecting kids online is appropriate public policy. "We're finally recognizing that perhaps big data collection on children is a form of child abuse... akin to sending them into a coal mine without a canary."

He added: "There are so many kids in our country and beyond who don't really understand what data is being collected about them, how that data is being shared and used, or even how the internet works. Children should receive education so they can appreciate the benefits and risks before they go online and provide personal information about themselves."

Age Flags

Jason highlighted that the age flag of the New York Child Data Protection Act stands out because "it's one of the first privacy laws to have a signal like that; and it's interesting because it adds a layer of transparency and, at least theoretically, empowers minors and their guardians to actively manage their privacy settings." He added that because of a potential gap in the technology needed for compliance, "covered parties should continue to monitor for additional guidance from" New York's attorney general.

He explained that an age flag is a digital identifier that tells websites, "I'm a minor, or should be treated as such, and I either do consent or don't consent to whatever you want to do with my data.' If the signal indicates that they do not consent, a website operator cannot ask for such consent but can provide a feature for the user to later consent."

Jason compared this to other states' age-verification laws, which he said can be more challenging to implement because "at least in practice, they equate to [having] actual knowledge of a user's age." Recent age-verification laws "attempt to shift this standard to a more constructive approach by using phrases like 'likely to be assessed by a child.' This can be confusing, particular[ly] for operators of general-audience websites. Notably, the New York law does not explicitly require age verification."

Compliance Recommendations

To ensure compliance with the New York Child Data Protection Act, Jason recommended that organizations conduct an "audit to identify the data they're collecting from minors and assess its purpose and necessity." He also said businesses should update "their privacy policies to make sure that they are clear and age-appropriate."

"User interfaces have to be made intuitive and aligned with age-appropriate design principles," Jason added. "Implementing data-minimization practices is also super important, as is training your staff about the latest privacy practices and legal requirements."

Read the full article (subscription may be required).

Hinshaw & Culbertson LLP is a U.S.-based law firm with offices nationwide. The firm's national reputation spans the insurance industry, the financial services sector, professional services, and other highly regulated industries. Hinshaw provides holistic legal solutions—from litigation and dispute resolution, and business advisory and transactional services, to regulatory compliance—for clients of all sizes. Visit www.hinshawlaw.com for more information and follow @Hinshaw on LinkedIn and X.