View full title
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
In one paragraph
New York's S 8524 (the "New York data protection act") would add General Business Law article 42-A, a consumer privacy framework. Controllers would have to give notice, honor access, correction and deletion requests, let consumers opt out of targeted ads, data sales and profiling for decisions with legal or similarly significant effects, and run data protection assessments for risky profiling and other high-risk processing. Data brokers would register annually with the attorney general, who could enforce the act with civil penalties up to $20,000 per violation. Introduced October 8, 2025; referred to the Internet and Technology Committee January 7, 2026. It has not passed either chamber.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
None yet: the bill is pending. If enacted, businesses serving New York with $25 million+ revenue, data on 50,000+ consumers, or over half their revenue from data sales would have to honor opt-outs from profiling and targeted ads and assess high-risk profiling.
Key provisions
- "Profiling" means automated processing of personal data to evaluate, analyze or predict personal aspects such as economic situation, health, preferences, reliability, behavior, location or movements
- Consumers could opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects (financial or lending services, housing, insurance, education, criminal justice, employment, health care, essential goods or services)
- Controllers would have to complete a data protection assessment for processing with heightened risk of harm, including profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact; the attorney general could require disclosure of an assessment relevant to an investigation (kept confidential)
- Other consumer rights include notice, access and a portable copy of data, correction and deletion; biometric information (including facial scans) is defined, with sensitive data subject to consent rules
- Data brokers would register annually with the attorney general; the attorney general would keep a public registry
- The attorney general could sue for injunctions, restitution, disgorgement and civil penalties of not more than $20,000 per violation, within six years
- Would apply to entities doing business in or targeting New York with annual gross revenue of $25 million or more, personal data of 50,000 or more consumers, or over 50% of revenue from selling personal data (§ 1201)
- Would take effect immediately, except sections 1201, 1202, 1203, 1205, 1206 and 1207 (scope, consumer rights, duties, enforcement), which would take effect two years after it becomes law; the data broker section (1204) would apply immediately
Latest legislative action
Jan 7, 2026. REFERRED TO INTERNET AND TECHNOLOGY
Sponsors (showing 5 of 9)
| Name | Role |
|---|---|
| BOYLE | Primary |
| COMRIE | Primary |
| HARCKHAM | Primary |
| Joseph A. Griffo | Primary |
| Kristen Gonzalez D | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error