Bill > S09131

This bill establishes new regulations for "data brokers," which are defined as businesses that knowingly collect and sell "personally identifiable information" (PII) to third parties, with some exceptions for businesses that primarily provide directory assistance or public safety alerts. The bill prohibits acquiring PII through fraudulent means or for purposes like stalking, harassment, fraud, or unlawful discrimination. It mandates that data brokers develop and maintain a comprehensive information security program with administrative, technical, and physical safeguards appropriate to their business size and the data they handle, including employee training, risk assessments, and measures to prevent unauthorized access. Furthermore, any data broker operating in New York must register annually with the Attorney General, paying a $100,000 fee and providing detailed information about their data collection, sale, and opt-out practices, including specific categories of sensitive data collected and whether data has been shared with foreign entities, governments, or AI developers. Violations of these provisions will be subject to enforcement and civil penalties under existing New York consumer protection laws, and the act is set to take effect on January 1, 2027.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/S9131