View full title
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
In one paragraph
New York's S 3044 (the New York privacy act) would add a consumer data privacy article to the General Business Law. Covered businesses would have to give notice, honor opt-outs of targeted advertising, data sales and profiling used for decisions with legal or similarly significant effects, and run data protection assessments. Referred to Senate Internet and Technology Committee January 23, 2025; reported to Finance May 29, 2025; referred back to Internet and Technology January 7, 2026; it has not passed either house.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
If enacted, covered businesses that process New Yorkers' personal data would have to give notice, honor opt-outs (including of profiling for significant decisions) and conduct risk assessments.
Key provisions
- Would apply to legal persons that do business in New York or target products or services to New York residents and have $25 million or more in annual gross revenue, process personal data of 50,000 or more consumers, or get over 50% of gross revenue from selling personal data (Section 1201)
- Consumers could opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; opt-in consent would be required for sensitive data (Section 1202)
- Profiling is defined as automated processing of personal data to evaluate, analyze or predict personal aspects such as economic situation, health, preferences, reliability, behavior, location or movements
- Controllers would have to regularly conduct and document data protection assessments for processing that presents a heightened risk of harm, including targeted advertising, data sales, and profiling with a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury (Section 1203)
- Data brokers would have to register annually with the attorney general by January 31 and pay a $100 fee or a fee the attorney general sets (Section 1204)
- The attorney general could seek injunctions, restitution, disgorgement and civil penalties of up to $20,000 per violation (Section 1206)
- Would take effect immediately, except sections 1201, 1202, 1203, 1205, 1206 and 1207 would take effect one year after becoming law
Latest legislative action
Jan 7, 2026. REFERRED TO INTERNET AND TECHNOLOGY
Sponsors (showing 5 of 8)
| Name | Role |
|---|---|
| Kristen Gonzalez D | Primary |
| ORTT | Primary |
| RIVERA | Primary |
| SANDERS | Primary |
| Zellnor Myrie D | Primary |
Roll call votes
Internet And Technology Vote May 27, 2025
6 yea1 nayPassed
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error