Your Rights as a New York Resident

While New York lacks a comprehensive privacy law, residents have limited privacy protections under existing state laws and active Attorney General enforcement.

• Right to data breach notification: Businesses must notify you within 30 days of discovering a breach affecting your personal information[17][4]
• Right to protection from deceptive privacy practices: The Attorney General can enforce against companies making false claims about their privacy practices[5][18][6]
• Right to child data protection: If you are under 18, online services must obtain consent before collecting your personal data[7][8][9]
• Right to health data protection: Once signed into law, you would have rights to control how health-related companies process your medical information[10][11]
• Right to accurate website privacy controls: Companies must ensure their cookie banners and privacy settings work as described[18][6]

These rights are significantly more limited than those available to residents of California, Virginia, and other states with comprehensive privacy laws[2][15].

Business Requirements

New York businesses currently face a patchwork of privacy-related obligations rather than comprehensive requirements.

• Data breach notification: Companies must notify affected residents and state regulators within 30 days of discovering a breach[17][4]
• Truthful privacy representations: Businesses cannot make deceptive claims about their privacy practices or website controls[5][18][6]
• Child data protection compliance: Online services must obtain consent before collecting data from users under 18[7][9]
• Medical data restrictions: Health-related companies would face strict consent requirements if the Health Information Privacy Act becomes law[10][11]
• Financial services compliance: Companies in financial services must now notify the Department of Financial Services of any data breaches[17][4]

Practical Impact

• Limited daily privacy protection: Without a comprehensive law, New York residents cannot easily access, delete, or control most of their personal data held by businesses[1][2]
• Enforcement depends on Attorney General action: Privacy violations are addressed reactively through consumer protection enforcement rather than proactive consumer rights[5][6]
• Strong child protections: Parents and teens under 18 have meaningful protections from data collection by online services[8][9]
• Breach notification improvements: The 30-day notification requirement provides faster alerts when personal information is compromised[17][4]
• Gap in comprehensive coverage: Most data collection, sharing, and selling by businesses remains largely unregulated[1][2]

Comparison Context

• Behind leading privacy states: New York lacks the comprehensive consumer rights available in California, Virginia, Colorado, and other states that enacted privacy laws[16][2]
• Stronger child protections: New York’s Child Data Protection Act extends protections to age 18, broader than the federal COPPA law which only covers children under 13[7][9]
• Active enforcement approach: The Attorney General’s office pursues privacy violations more aggressively than many states, even without comprehensive privacy legislation[5][6]
• Potential for stronger future law: Proposed legislation would provide more comprehensive rights than many existing state laws, including stronger opt-in consent requirements[1][2][15]

Action Steps for Residents

• Monitor breach notifications: Watch for required 30-day notifications from companies about data breaches affecting your information[17][4]
• Verify privacy controls work: Test that website cookie settings and privacy controls actually function as described[18][6]
• Report deceptive privacy practices: File complaints with the Attorney General’s office about companies making false privacy claims[5][6]
• Stay informed on legislative progress: Follow developments on the New York Privacy Act and related bills in the state legislature[1][13]
• Exercise existing federal rights: Use available protections under federal laws like COPPA for children and sector-specific regulations[7]
• Contact representatives: Advocate for passage of comprehensive privacy legislation by contacting your state legislators[1]

Official Resources and Contact Information

New York State Legislature

Track privacy legislation including the New York Privacy Act (S3044/A4947) and Data Protection Act (A974) through the official legislature website. Contact your specific representatives to advocate for privacy legislation.

Website: https://www.nysenate.gov and https://www.assembly.state.ny.us

Find Your Senator: https://www.nysenate.gov/find-my-senator

Find Your Assembly Member: https://www.assembly.state.ny.us/mem/

New York Attorney General’s Office

The Attorney General’s office handles privacy enforcement and consumer protection complaints. They also provide guidance on privacy practices and investigate deceptive business practices.

Consumer Protection Hotline: 1-800-771-7755

Online Complaint Form: https://ag.ny.gov/consumer-frauds/filing-consumer-complaint

Main Website: https://ag.ny.gov

Committee on Open Government

This state agency provides advice on privacy rights under New York’s Personal Privacy Protection Law and maintains directories of government record systems.

Website: https://opengovernment.ny.gov

Phone: (518) 474-2518

Email: coog@dos.ny.gov

Governor’s Office

Contact Governor Kathy Hochul’s office to advocate for signing pending privacy legislation or supporting new privacy initiatives.

Website: https://www.governor.ny.gov

Phone: (518) 474-8390

Constituent Services: https://www.governor.ny.gov/content/governor-contact-form

Sources and Citations

Last Updated August 2025. Written with contributions from both human authors and Perplexity AI. If you find incorrect or outdated information let us know at support@optery.com.