New York Privacy Law

Current Status

New York has attempted to pass comprehensive data privacy legislation for several consecutive sessions without success. The New York Privacy Protection Act (NYPPA) was most recently introduced in the 2024 legislative session as Senate Bill S 365 and Assembly Bill A 3312. It passed the Senate Consumer Protection Committee but stalled in the full Senate amid intense lobbying from the technology and financial services industries based in New York City. The NYPPA has consistently been one of the most consumer-friendly proposed privacy laws in the country — which is precisely why it has faced such fierce opposition. It includes a robust private right of action (allowing individuals to sue companies directly) and data minimization requirements that would significantly constrain how companies use personal data. Business groups have argued these provisions would expose companies to excessive litigation and stifle innovation. Consumer advocates counter that without a private right of action, any privacy law is unenforceable in practice. New York's political dynamics are complex: the state legislature is controlled by Democrats who broadly support privacy rights, but the New York financial and tech industries are powerful economic forces with significant lobbying clout. Governor Hochul has not yet publicly committed to signing a comprehensive privacy bill.

Legislative Timeline

What the Bill Proposes

The NYPPA is among the most ambitious state privacy proposals in the country. Key features include: data minimization requirements (companies may only collect data reasonably necessary for a disclosed purpose); a private right of action allowing individuals to sue companies for violations without waiting for government enforcement; data protection impact assessments for high-risk processing; opt-in consent for sensitive data; and all standard consumer rights (access, correction, deletion, portability, opt-out of sale and targeted advertising). Unlike most other state laws, the NYPPA would also establish a data fiduciary duty — treating companies that handle personal data as having a legal obligation to act in users' interests, similar to how financial advisors are required to act in their clients' interests.

Proposed Consumer Rights

If enacted as currently drafted, New York residents would receive the following privacy rights:

Key Provisions of the Proposed Bill

• Data Fiduciary Requirement: Companies handling personal data would be legally obligated to act in the best interests of consumers — a concept borrowed from financial law that goes far beyond what any other state has enacted.
• Private Right of Action: Consumers could sue companies directly for violations without waiting for the Attorney General to act — the most contentious and powerful provision in the bill.
• Data Minimization: Companies could only collect and use data that is reasonably necessary for the disclosed purpose — no more "collect everything, figure out a use later" practices.
• Opt-In for Sensitive Data: Processing of health, financial, racial, religious, sexual orientation, and geolocation data would require explicit opt-in consent.
• No Discriminatory Pricing: Companies could not charge different prices based on whether a consumer exercises their privacy rights — stronger than most state laws.
• Coverage: Would apply to any for-profit entity doing business in New York that collects data of 100,000+ consumers or derives over 50% of revenue from personal data sales.

Why It Hasn't Passed Yet

The NYPPA's failure to pass despite multiple attempts comes down to three core disagreements: (1) The private right of action — business groups warn this would trigger a wave of class action lawsuits; advocates say without it the law has no teeth; (2) The data fiduciary duty — requiring companies to act in consumers' best interests is a radical departure from existing U.S. privacy law and industries have vigorously opposed it; (3) The scope of data minimization — companies that have built entire business models on collecting and monetizing data argue that strict minimization requirements would make many current business practices illegal overnight. Finding compromise language that satisfies both consumer advocates and the business community has proven elusive across multiple sessions.

How New York Compares to States With Laws

Feature	New York (Proposed)	Virginia (Active)	California (Active)
Comprehensive privacy rights	Proposed	✅ Yes	✅ Yes
Right to delete	Proposed	✅ Yes	✅ Yes
Opt out of sale of data	Proposed	✅ Yes	✅ Yes
Sensitive data protections	Proposed	✅ Yes	✅ Yes
Enforcement agency	TBD	VA Attorney General	CA Privacy Protection Agency
Private right of action	TBD	No	Yes (breach only)
Currently enforceable	❌ No	✅ Yes	✅ Yes

What You Can Do Right Now

Even though New York does not yet have a comprehensive privacy law, you are not without options:

• Contact your state legislators — Tell your state senator and representative you support strong data privacy legislation. Personal constituent messages are more impactful than form letters.
• Use your federal rights — HIPAA protects your medical data, COPPA protects children's data under 13, and FCRA gives you rights over your credit data nationwide.
• Exercise California rights if you travel or have accounts there — Some companies apply CCPA rights to all users regardless of state.
• Opt out of data brokers directly — Even without a state law, you can submit opt-out requests to major data brokers. Many comply voluntarily.
• Enable the Global Privacy Control — States like California and Colorado legally require websites to honor this browser signal, which still protects your data on those sites.

Stay Updated on New York's Privacy Law Progress

Privacy legislation moves quickly. Subscribe to our newsletter and we'll alert you the moment New York passes a new privacy bill, a vote is scheduled, or a major amendment changes the bill's scope. You'll also receive our monthly digest of all U.S. privacy law changes — free, always.