View full title
Requires the registration of data brokers; imposes regulations upon data brokers; establishes a data deletion mechanism for consumers; imposes penalties upon data brokers for violations of the law.
In one paragraph
New York's S 9088-A would add General Business Law Article 42-A (§§ 1150-1158) requiring data brokers to register with the Attorney General within 60 days with a $100 fee (or an amount the Attorney General sets) and disclose, among other things, data shared with AI developers. The Attorney General must build a one-request deletion mechanism within a year of the effective date, after which brokers must stop processing within five days and delete within 45 days. Penalties reach $500 per day or per request. Passed the Senate June 3, 2026 (51-10); referred to the Assembly Consumer Affairs and Protection Committee June 4, 2026.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
None yet: the bill is pending. If enacted, data brokers would have to register, honor deletion requests, post metrics and undergo audits.
Key provisions
- Covered business: does business in New York and has annual gross revenue over $10 million, buys/sells/shares data of 100,000 or more consumers or households, or gets 50% or more of revenue from selling or sharing personal information
- Registration with the Attorney General within 60 days of becoming a data broker; disclosures include sharing in the past five years with foreign actors, governments, law enforcement and AI developers; Attorney General keeps a public registry
- Attorney General must establish a free deletion mechanism within one year of the effective date; six months later brokers must cease processing within five days of a verifiable request and delete within 45 days, checking the mechanism at least every 45 days
- Independent third-party audits starting three years after the effective date and every three years, reports to the Attorney General within five business days of request
- Annual website disclosures by July 1 (privacy policy, deletion request counts, median and mean response times) and a documented information security program
- Penalties: $500 per day for failing to register, $500 per deletion request per day for failing to delete, $250 per day for website disclosure failures; Attorney General may also seek an injunction; no private right of action is stated
- Exempts HIPAA covered entities and business associates (to the extent they comply), certain research, FCRA- and Gramm-Leach-Bliley-covered information and election-law committees; would take effect immediately; Assembly version A9642
Latest legislative action
Jun 4, 2026. referred to consumer affairs and protection
Sponsors
| Name | Role |
|---|---|
| FELDER | Primary |
| HARCKHAM | Primary |
| Kristen Gonzalez D | Primary |
| PERALTA | Primary |
| Thomas F. O'Mara | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error