Memorandum Opposing TEDE Article VII, Part Y’s Safe Design Framework for Online Platforms
SUMMARY
The Lesbian, Gay, Bisexual, Trans and Queer+ Rights Committee (Hayley Gornberg and Jared Trujillo, Co- Chairs) and Civil Rights Committee (Evan Henley, Co-Chair) issued a memo urging the State Legislature and Governor Hochul to oppose Part Y of the Fiscal Year 2027 Executive Budget, arguing that while it aims to enhance youth online safety, it instead raises serious constitutional, privacy, and technological concerns. The proposal’s requirements such as mandatory age assurance, restrictions on platform design, parental notification mechanisms, and anti-circumvention rules would likely burden anonymous speech, expand the collection of sensitive personal data, and create pressure to weaken encryption. These measures risk exposing users to data security threats, undermining existing privacy protections, and chilling lawful online expression for both adults and minors.
The memo further argues that the bill infringes on First Amendment rights by conditioning access to online speech on identity verification and broadly restricting minors’ ability to communicate and engage online. Provisions limiting private messaging and triggering parental notification could deter young people particularly LGBTQ+ youth and those in unsupportive environments from seeking critical resources or exploring their identities safely, potentially exposing them to harm. The committees also raised concerns about the use of the budget process to advance such sweeping legislation without adequate public input, urging instead a more transparent, deliberative, and constitutionally sound legislative approach.
OUTCOME
Adopted as part of the FY 2027 NYS Budget
REPORT
REPORT ON LEGISLATION BY THE
LESBIAN, GAY, BISEXUAL, TRANSGENDER & QUEER RIGHTS COMMITTEE,
THE CIVIL RIGHTS COMMITTEE, AND THE SEX & LAW COMMITTEE
A.10008-A / S.9008-A (Budget Article VII Legislation, Transportation, Economic Development and Environmental Conservation) – Part Y
AN ACT to amend the general business law, in relation to establishing the “Safe by Design Act”
THIS BUDGET PROVISION IS OPPOSED
I. SUMMARY
The New York City Bar Association (the “City Bar”), through the LGBTQ+ Rights Committee, the Civil Rights Committee, and the Sex and Law Committee, urge the State Legislature and Governor Hochul to oppose Transportation, Economic Development and Environmental Conservation (“TEDE”) Article VII, Part Y in the Fiscal Year 2027 Executive Budget. While the goal of enhancing youth safety online is laudable, the budget proposal does not do that. Instead, it raises substantial constitutional, privacy, technological, and interstate commerce concerns that warrant careful deliberation through the regular legislative process with hearings and stakeholder input – rather than being rushed through the opaque budget process.
The bill’s mandatory “age assurance” regime, restrictions on platform design, parental-notification architecture, and anti-circumvention provisions collectively burden anonymous speech, create regulatory pressure against encrypted communication, expand sensitive data collection, and risk constitutional challenge under the First Amendment and related doctrines. These risks are particularly acute for LGBTQ+ youth and other vulnerable young people, for whom online spaces often provide critical access to community, information, and support that may not be available in their immediate environments.
Rather than enhancing safety, the proposal risks undermining it by restricting access to the very online spaces that many young people rely on for support, information, and connection.
II. ENCRYPTION AND PRIVACY-PRESERVING TECHNOLOGIES
Although the proposal does not explicitly prohibit encryption, its structure creates regulatory pressure against privacy-preserving technologies, including end-to-end encrypted communication.
Encryption is a security mechanism that ensures that only intended recipients can read communications—not platforms, hackers, or third parties. End-to-end encryption is widely regarded as a critical safeguard against data breaches, stalking, and unauthorized access.
The bill’s anti-circumvention requirement and prohibition on “subversive” design features may incentivize platforms to link accounts to verified identities, retain additional metadata about communications, or modify encryption architectures in ways that increase the amount of user data accessible. Such changes would expand the volume of sensitive information subject to collection, storage, and potential disclosure.
New York has enacted shield laws designed to protect individuals seeking reproductive and gender-affirming care from hostile out-of-state investigations. Those protections may be undermined if communications become more accessible through weakened encryption or identity-linked architecture. Legislation that indirectly pressures platforms away from secure, encrypted communication raises significant privacy and security concerns.
III. AGE ASSURANCE AND ANONYMOUS SPEECH
The proposal requires online platforms to conduct “age assurance” using methods that “reasonably prevent circumvention” and expressly prohibits reliance on self-declaration of age. In practice, these provisions likely require platforms to harvest personal data through identification uploads, third-party verification services, or biometric age-estimation tools that analyze a user’s facial features. Requirements to submit personal information to access constitutionally protected online communications are incompatible with privacy and anonymity. They will ultimately deprive users who cannot or do not want to verify themselves of a platform for communication. All users, both adults and youth, who choose to verify their identity risk having their data disseminated or exploited.
As a result, this statute is constitutionally dubious at best. Courts have repeatedly recognized that anonymity is an important component of freedom of speech, particularly where identification requirements may deter participation in public discourse. Further, age-verification laws affecting access to online speech have long been subject to constitutional scrutiny, as compelled identity disclosure to access protected speech can chill participation and impose undue burdens on adults as well as minors.[1]
While the Supreme Court recently upheld a Texas age-verification law applicable to commercial pornography websites,[2] that decision addressed a statute narrowly targeted at websites distributing sexual material harmful to minors. The proposed budget language is materially broader. Rather than regulating access to a specific category of explicit material, the budget proposal would impose age-assurance requirements across general-purpose online platforms used for ordinary communication and association.
The requirement that information collected for age assurance be deleted after an age determination is made does not eliminate the underlying constitutional and privacy concerns. The First Amendment burden arises at the moment individuals are required to disclose identifying information in order to access protected speech, regardless of whether the information is later deleted. Moreover, age-verification systems frequently involve third-party credentialing services, biometric estimation tools, or other verification vendors, and users have no practical ability to confirm whether personal information submitted during the verification process has, in fact, been deleted. Even when identifying documents are removed, platforms may retain verification tokens, timestamps, device identifiers, or other metadata indicating that verification occurred, creating persistent records associated with user accounts.
In addition, the legislation permits retention of information where required for compliance with other laws or regulations, further limiting the practical scope of the deletion safeguard. More broadly, mandating age-assurance infrastructure risks normalizing identity-linked verification systems across online platforms. Once deployed, such systems may be reused or expanded for additional purposes, increasing the volume of sensitive information collected and stored in digital environments that are already frequent targets for data breaches and unauthorized access.
IV. YOUTH SPEECH RIGHTS AND COMPELLED DISCLOSURE CONCERNS
Minors possess First Amendment rights, and courts have long recognized that young people are entitled to engage in speech, association, and the exchange of information, including in educational and communicative settings. While the government may adopt certain measures to protect minors, regulations affecting their speech must still be carefully tailored and must not unnecessarily burden lawful expression or association.
Part Y, by default, broadly restricts how minors may communicate online. The proposal limits private messaging between minors and individuals who do not have preexisting online connections with them, restricts who may view or respond to a minor’s posted media, and requires parental notification when minors attempt to alter certain privacy settings. In combination, these provisions do not merely regulate specific harmful conduct; they restructure how minors may participate in online discourse by imposing broad limitations on communication and association across general-purpose online platforms.
Unlike laws that target discrete categories of unlawful activity, such as exploitation or harassment, the Safe Design Act regulates lawful speech and association at scale. Online platforms are a central forum for minors to access news, engage in civic discussion, participate in educational communities, and connect with peers. Restrictions that condition or limit those interactions, therefore, implicate significant First Amendment interests.
These concerns are particularly acute for LGBTQ+ youth and other vulnerable young people who may rely on online spaces to seek information, community, or support that is not available in their immediate environments. For many young people, online communication provides access to affirming communities, crisis resources, and educational information about health, identity, and rights. Broad restrictions that limit private communication or trigger parental notification may deter minors from seeking such support or participating in online communities where they can safely explore questions of identity and belonging.
In addition to deterrence and isolation, these policies may expose vulnerable youth to affirmative risks. For some young people, particularly those in unsupportive or hostile households, compelled disclosure of online activity or identity-related exploration can result in family rejection, loss of housing, or other forms of harm. Even where such consequences are not immediate, the possibility of disclosure may force young people to forgo accessing critical resources or engaging in supportive communities. In this respect, policies that broadly limit private communication or condition it on parental visibility risk not only isolating vulnerable youth, but placing them in situations of heightened instability or danger.
Recent litigation highlights the broader national context in which these questions are arising. Across the country, courts are increasingly asked to address government policies that affect how schools and institutions handle sensitive information about students’ identities and expressions. Earlier in March 2026, in Mirabelli v. Bonta, the Supreme Court allowed a lower court decision to stand that invalidated a California policy barring schools from disclosing a student’s gender identity to parents without the student’s consent.[3] The litigation reflects a wider national debate about youth privacy, parental notification, and the availability of safe spaces for minors to communicate and explore identity. At a time when schools and libraries across the country are confronting book bans and restrictions on discussion of sexual orientation and gender identity, New York should be cautious about adopting policies that may further limit safe channels of communication for young people.
In this evolving environment, legislation that mandates or structurally pressures disclosure of minors’ identity-related information raises significant constitutional considerations. Policies that broadly condition minors’ ability to communicate online on parental notification or disclosure mechanisms warrant careful review to ensure they are appropriately tailored to legitimate safety objectives while respecting the constitutional rights of young people.
V. PROCESS CONCERNS
Finally, the Executive Chamber is attempting to pass Part Y through the budget process, rather than through standalone legislation. This legislation could fundamentally change New Yorkers’ relationship to online communication and privacy, and it is far too complex to pass without meaningful debate from impacted stakeholders, including youth groups, privacy advocates, parents, and the platforms themselves. Legislators should be able to ask questions about this complicated topic, and the public should be able to vet the harms and benefits of this proposal. Moreover, enacting legislation of this scope through the opaque budget process risks significant constitutional litigation.
VI. CONCLUSION
For these reasons, Part Y raises substantial constitutional and policy concerns regarding minors’ speech, privacy, and safety. These issues sit at the intersection of rapidly evolving technology and well-established constitutional protections and require careful legislative consideration. Advancing such sweeping changes through the budget process—without meaningful hearings or stakeholder input—risks unintended harm and invites constitutional challenge.
The City Bar’s LGBTQ + Rights and Civil Rights Committees support efforts to protect young people online. We urge the Legislature and Governor Hochul to pursue this goal through a measured, transparent, and constitutionally sound legislative process.
LGBTQ+ Rights Committee
Jared Trujillo, Co-Chair
Hayley Gorenberg, Co-Chair
Civil Rights Committee
Evan Henley, Co- Chair
Sex & Law Committee
Natalie R. Birnbaum, Co-Chair
Susan E. Cersovsky, Co-Chair