Bill > A05827

This bill establishes comprehensive data privacy and protection regulations in New York, creating a robust framework for consumer data rights and corporate accountability. The American Data Privacy and Protection Act introduces sweeping provisions that cover how businesses collect, process, and transfer personal data, with several key elements: First, it requires covered entities to minimize data collection, only gathering information that is necessary and proportionate to specific purposes. Second, it establishes strong consent mechanisms, mandating that companies obtain clear, explicit permission from individuals before collecting or transferring their sensitive data. Third, the bill creates significant protections for children and minors, prohibiting targeted advertising to individuals under 17 and restricting data transfers involving minors. Fourth, it requires large data holders to conduct privacy impact assessments and implement robust data security practices. Fifth, the legislation establishes enforcement mechanisms through the Division of Consumer Protection and the Attorney General's office, with provisions for both government enforcement and individual civil actions. The bill also creates a Privacy and Security Victims Relief Fund to provide compensation and support for individuals affected by data privacy violations. Notably, the law applies to a wide range of entities, including businesses, service providers, and third-party data collectors, with some exemptions for small businesses and certain types of organizations.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/A5827