View full title
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
In one paragraph
New York's A 8158 (the "New York privacy act") would add General Business Law Article 42-A (§§ 1200-1207). Among other consumer rights, people could opt out of "profiling in furtherance of decisions that produce legal or similarly significant effects" (such as lending, housing, insurance, employment and health care), and controllers would have to run data protection assessments for profiling that presents a reasonably foreseeable risk of unfair treatment or unlawful disparate impact. Only the Attorney General could enforce it, with penalties of up to $20,000 per violation. Introduced May 2, 2025 and referred to Consumer Affairs and Protection (again January 7, 2026); not passed.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
None yet: the bill is pending. If enacted, covered businesses would have to honor opt-outs from significant-decision profiling and assess profiling risks, among other privacy duties, or face Attorney General penalties.
Key provisions
- Applies to entities doing business in New York or targeting residents that have $25 million+ annual gross revenue, process data of 50,000+ consumers, or derive over 50% of revenue from selling personal data
- "Profiling" is automated processing of personal data to evaluate, analyze or predict a person's economic situation, health, preferences, interests, reliability, behavior, location or movements (§ 1200(20))
- § 1202(2): consumers may opt out of targeted advertising, sales, and profiling in furtherance of decisions with legal or similarly significant effects; controllers must honor browser or device opt-out signals
- § 1203(1)(a): data protection assessments required, including for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact; assessments are confidential and the Attorney General may request them
- Other rights: notice, opt-in consent for sensitive data, access, portability, correction, deletion within 45 days; data brokers must register annually with the Attorney General (§ 1204)
- § 1206: Attorney General enforcement only, civil penalties of not more than $20,000 per violation; no private right of action
- §§ 1200 and 1204 take effect immediately; §§ 1201-1203 and 1205-1207 take effect one year after it becomes law
Latest legislative action
Jan 7, 2026. referred to consumer affairs and protection
Sponsors (showing 5 of 13)
| Name | Role |
|---|---|
| BYRNE | Primary |
| DICKENS | Primary |
| Nily Rozic D | Primary |
| Patricia Fahy | Primary |
| PRETLOW | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error