View full title
Requires the registration of data brokers; imposes regulations upon data brokers; establishes a data deletion mechanism for consumers; imposes penalties upon data brokers for violations of the law.
In one paragraph
New York's A 9642-A would add General Business Law Article 42-A (§§ 1150-1158). Data brokers would have to register with the Attorney General within 60 days after meeting the definition and disclose, among other things, whether they have "shared or sold consumers' data to a developer of an artificial intelligence system or model in the past five years." The Attorney General would set up a free data deletion mechanism, and brokers would have to process and delete requests within 45 days of receipt, with penalties of $500 per day for failing to register or delete. Introduced January 21, 2026; amended and recommitted to Consumer Affairs and Protection June 1, 2026; not passed.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
None yet: the bill is pending. If enacted, data brokers would have to register, report any sale of data to AI developers, honor deletion requests and submit to audits, or face daily penalties.
Key provisions
- § 1151: register with the Attorney General within 60 days after meeting the definition, $100 fee (or as the Attorney General sets); disclose whether data was shared or sold to a foreign actor, government, law enforcement or an AI developer in the past five years
- "Business" thresholds: over $10 million gross revenue, data of 100,000+ consumers or households, or 50%+ of revenue from selling or sharing data
- § 1152: Attorney General must create a free deletion mechanism within one year of the effective date; starting six months after it exists, brokers must check it at least every 45 days, delete within 45 days of receipt and stop processing within five days of a verifiable request
- § 1153: independent third-party audit starting three years after the effective date and every three years; § 1154: yearly website disclosure of deletion-request statistics; § 1155: information security program
- § 1157: Attorney General enforcement only; $500 per day for failure to register, $500 per request per day for failure to delete, $250 per day for website disclosure failures; no private right of action
- The bill contains no profiling or automated decision-making rules; its AI content is the AI-developer disclosure and AI-related definitions
- Would take effect immediately; same as S9088
Latest legislative action
Jun 1, 2026. amend and recommit to consumer affairs and protection
Sponsors (showing 5 of 23)
| Name | Role |
|---|---|
| Alex Bores D | Primary |
| ARROYO | Primary |
| Emerita Torres | Primary |
| JACOBSON | Primary |
| MAYER | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error