Bill > S03044

This bill enacts the New York Privacy Act, which aims to give consumers more control over their personal data and impose significant responsibilities on companies that collect, process, or sell such data. The bill requires companies doing business in New York to provide clear, easily understandable notices about their data practices, obtain explicit consent before processing sensitive data, and allow consumers to access, correct, delete, and transfer their personal information. Companies must limit data collection and retention, implement robust data security measures, and are prohibited from discriminating against consumers who exercise their privacy rights. The bill applies to businesses with annual revenues over $25 million, those processing data of 50,000 or more consumers, or those deriving over 50% of their revenue from selling personal data. Data brokers must register with the Attorney General, and the law empowers the Attorney General to enforce these provisions through civil penalties of up to $20,000 per violation. Notably, the bill includes comprehensive definitions of personal data, sensitive data, and various data processing activities, and provides detailed requirements for obtaining consent, with special protections for sensitive information like racial, health, or location data.

Budget and Finance, Business and Industry

https://www.nysenate.gov/legislation/bills/2025/S3044