Bill > S08524

This bill enacts the New York Data Protection Act, a comprehensive privacy law designed to give New York consumers more control over their personal data. The bill requires companies that meet certain revenue or data processing thresholds to provide clear notices about data collection, allow consumers to opt out of targeted advertising and data sales, and obtain explicit consent before processing sensitive data. Key consumer rights include the ability to access, correct, delete, and transfer personal data. Companies must implement reasonable data security measures, conduct regular data protection assessments, and limit data collection and retention. The bill mandates that companies develop contracts with processors and third parties that handle personal data, ensuring data protection and consumer privacy. Data brokers must register with the Attorney General and provide detailed information about their data collection practices. The Attorney General is empowered to enforce the law, with potential civil penalties of up to $20,000 per violation. The law preempts local privacy regulations and will take effect two years after becoming law, giving businesses time to adapt to the new requirements. The bill's goal is to provide transparency, increase consumer control, and protect personal data in an increasingly digital world.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/S8524