Bill > A00974

This bill enacts the New York Data Protection Act, a comprehensive privacy law designed to give New York residents more control over their personal data. The bill requires companies that do business in New York or target New York residents to provide clear, easily understandable notices about how they collect, use, and share personal data. Specifically, companies must disclose the categories of data they collect, the sources of that data, the purposes for processing it, and the third parties with whom the data is shared. The bill gives consumers several key rights, including the right to opt out of targeted advertising and data sales, the right to access and correct their personal data, the right to request deletion of their data, and the right to receive their data in a portable format. Companies must obtain explicit, informed consent before processing sensitive data like racial, health, or biometric information. The law applies to businesses that meet certain revenue or data processing thresholds and includes detailed requirements for how companies must handle personal data, including implementing reasonable security safeguards and entering into specific contractual agreements with data processors and third parties. Violations can result in significant penalties, with the New York Attorney General empowered to bring actions and impose civil penalties of up to $20,000 per violation. The bill aims to enhance consumer privacy protections by giving individuals more transparency and control over their personal information.

Business and Industry, Housing and Urban Affairs

https://www.nysenate.gov/legislation/bills/2025/A974