View full title
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
In one paragraph
New York's A 974-A, the "New York data protection act," would add General Business Law Article 42-A letting consumers opt out of profiling (automated processing of personal data to evaluate or predict personal traits) in furtherance of decisions that produce legal or similarly significant effects, and requiring a data protection assessment for profiling with a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers. It would also add targeted-advertising and data-sale opt-outs and other rights, with Attorney General civil penalties of up to $20,000 per violation. Amended May 29, 2026 and recommitted to Codes; not passed by either chamber.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
None yet: the bill is pending. If enacted, businesses meeting the thresholds would have to honor opt-outs from significant-decision profiling, assess risky profiling and meet other data duties, with Attorney General penalties up to $20,000 per violation.
Key provisions
- Short title "New York data protection act"; the page's older description called it the "New York privacy act"
- "Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects such as economic situation, health, preferences, reliability, behavior, location or movements (§ 1200(17))
- Controllers must let consumers opt out, at any time, of profiling in furtherance of decisions that produce legal or similarly significant effects, defined to include financial or lending services, housing, insurance, education enrollment, criminal justice, employment, health care and essential goods or services (§ 1202(2)(a)(iii))
- Profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers (among other listed risks) requires a data protection assessment (§ 1203(1)(a)(i)(C))
- Applies to businesses with annual gross revenue of $25 million or more, personal data of 100,000 or more consumers, or over 50% of gross revenue from the sale of personal data (§ 1201)
- The Attorney General may bring an action for civil penalties of not more than $20,000 per violation (§ 1205)
- Would take effect immediately, except GBL §§ 1201-1206 would take effect two years after it becomes law
Latest legislative action
May 29, 2026. amend and recommit to codes
Sponsors (showing 5 of 21)
| Name | Role |
|---|---|
| Nily Rozic D | Primary |
| RICHARDSON | Primary |
| Robert C. Carroll D | Primary |
| SIMOTAS | Primary |
| Andrew Hevesi D | Cosponsor |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error