New York
💡 Last Updated October 2025. Written with contributions from both human authors and LLMs. If you find incorrect or outdated information let us know at support@optery.com.
Data brokers are selling your personal information. Optery finds it and removes it for you.
Privacy law in New York
There is no signed, comprehensive consumer privacy law in New York yet. Assembly Bill A. 4947 — the 'New York Privacy Act' (NYPA) — was introduced in the 2025–2026 legislative session and referred to the Committee on Consumer Affairs and Protection, but it has not been passed or signed into law. If enacted, it would give New York residents broad rights over their personal data, including the right to access, correct, delete, and port their data, as well as the right to opt in before companies process or sell it. Until the bill passes, New York residents are protected mainly by sector-specific state laws and federal privacy frameworks.
What protections do exist in New York
New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act)
Requires businesses that own or license computerized data including private information of New York residents to notify affected residents when a breach of their private information occurs. It also requires covered businesses to implement reasonable data security programs to protect private information. (N.Y. Gen. Bus. Law § 899-aa; N.Y. Gen. Bus. Law § 899-bb)
New York Biometric Privacy Law (New York City Administrative Code § 22-1201 et seq.)
New York City enacted a biometric identifier information law requiring commercial establishments to post a clear and conspicuous notice if they collect biometric identifier information from customers. Violations can result in civil penalties. (N.Y.C. Admin. Code § 22-1201 et seq.)
New York Education Law § 2-d
Protects the personally identifiable information of students in New York public schools. It restricts how educational agencies and third-party contractors can collect, use, and share student data, and gives parents rights to access and correct their child's educational records. (N.Y. Educ. Law § 2-d)
New York General Business Law § 380 et seq. (Fair Credit Reporting)
New York's state-level credit reporting law supplements the federal Fair Credit Reporting Act, providing New York consumers additional rights regarding the accuracy of their credit reports and the use of credit information by employers and others. (N.Y. Gen. Bus. Law § 380 et seq.)
Federal protections that apply to New York residents
Even without a comprehensive state privacy law, federal protections apply to New York residents. The FTC's Section 5 authority prohibits unfair or deceptive data practices by businesses. HIPAA protects medical records held by health providers and insurers. COPPA restricts the collection of personal data from children under 13. The Gramm-Leach-Bliley Act provides some protections for financial account data. These laws are enforced federally but provide a meaningful floor of privacy protection.
What’s happening in the New York legislature
Several privacy bills have been introduced in New York. None has passed into law yet, but they signal where consumer privacy legislation in the state may be heading.
A. 4947 — New York Privacy Act
A. 4947, the New York Privacy Act, would give New York residents rights to access, correct, delete, and obtain a portable copy of their personal data held by businesses. It would require businesses to obtain opt-in consent before processing or selling personal data, ban retaliation against consumers who exercise their rights, and create a private right of action for injured consumers. The bill was introduced on February 10, 2025, and referred to the Assembly Committee on Consumer Affairs and Protection. Status: in committee.
How Optery helps New York residents
Data brokers collect and sell personal information about almost every American adult — home addresses, phone numbers, family relationships, employment history. They do this regardless of whether your state has a comprehensive privacy law. Optery scans over 200 data brokers to find where your information is exposed, then submits removal requests on your behalf and tracks compliance. Our service works for every US resident, not just those in states with strong privacy statutes.