View full title
Establishes consumers' foundational data privacy rights; creates oversight mechanisms; establishes enforcement mechanisms; establishes the privacy and security victims relief fund.
In one paragraph
New York's A5827 (2025-26) would add a new Article 46, the "American Data Privacy and Protection Act", to the General Business Law, covering data minimization, a duty of loyalty, consumer rights to access, correct, delete and port covered data, and consent and opt-out rules for transfers and targeted advertising; its title also establishes a privacy and security victims relief fund. A large data holder using a covered algorithm in a way that poses a consequential risk of harm would have to conduct an impact assessment of it. Referred to the Assembly Science and Technology Committee February 20, 2025 and again January 7, 2026; not enacted.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
Not law. If enacted, covered entities would have to meet its data privacy duties, and large data holders using risk-posing algorithms would have to run impact assessments.
Key provisions
- Would add new Article 46 (Data Privacy and Protection) to the General Business Law and redesignate existing Article 46 as Article 60
- Consumer rights to access, correct, delete and port covered data, with consent and opt-out requirements for transfers and targeted advertising
- "Covered algorithm" is defined as a computational process that uses machine learning and similar techniques to make decisions or support human decision-making about covered data
- Section 1626(3): a large data holder using a covered algorithm that poses a consequential risk of harm would have to conduct an impact assessment covering design, inputs, outputs and mitigation
- Section 1626(3)(B): a covered entity or service provider that knowingly develops a covered algorithm to process covered data for consequential decisions would have to evaluate its design, structure and inputs before deploying it
- "Large data holder" is defined using thresholds that include annual gross revenues of $250 million or more and the volume of covered and sensitive covered data processed
- Referred to the Assembly Committee on Science and Technology February 20, 2025 and again January 7, 2026
Latest legislative action
Jan 7, 2026. referred to science and technology
Sponsors (showing 5 of 10)
| Name | Role |
|---|---|
| BYRNE | Primary |
| Catalina Cruz D | Primary |
| DINOWITZ | Primary |
| Michaelle C. Solages D | Primary |
| TITUS | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error