NY S04276: Enacts the "digital fairness act"; requires any entity that conducts business in New York and maintains the personal information of 500 or more indiv…

In one paragraph

New York's S 4276 (the digital fairness act) would require businesses holding personal information of 500 or more people to give short-form privacy notices, get opt-in consent, and bar discriminatory targeted advertising. It would also set rules for government automated decision systems: use policies, notice, human review and impact assessments. Referred to the Senate Internet and Technology Committee February 3, 2025, and again January 7, 2026; it has not passed either house.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

If enacted, businesses holding personal information of 500 or more New Yorkers would face consent, notice and non-discrimination duties; vendors of government decision systems would face procurement conditions.

Key provisions

1. 1Covered entities (doing business in New York and holding personal information of 500 or more people) would need opt-in consent to process personal information, a short-form privacy notice of up to 500 words, and duties of care and loyalty
2. 2Would make it unlawful to process personal information or target advertisements for employment, finance, health care, credit, insurance, housing or education in a way that discriminates on protected characteristics
3. 3Covered entities and governmental entities with biometric information would need a public retention and destruction policy, and covered entities would need written notice and a signed release before collecting it
4. 4State agencies and local governments using automated decision systems that determine rights, benefits, opportunities or services would have to publish use policies, get legislative or council approval, give plain-language notice, and provide human review
5. 5After requesting human review, a person could sue if the review upholds the system's decision, or overturns it but the government cannot or will not remedy the resulting harm, for the greater of actual damages or $10,000 per violation; agencies would publish yearly human-review metrics
6. 6Would bar state payments for such automated decision systems unless they use only open source software and have a completed impact assessment and use policy
7. 7Individuals could sue for the greater of $10,000 or actual damages, plus punitive damages and attorney's fees; the attorney general, district attorneys and city attorneys of cities over 750,000 could seek civil penalties of up to $25,000 per violation or up to 4% of annual revenue
8. 8Sections 1 to 6 would take effect one year after becoming law and section 8 two years after; the rest immediately

Latest legislative action

Jan 7, 2026. REFERRED TO INTERNET AND TECHNOLOGY

Sponsors