This bill prohibits data brokers from selling the personal information of current or former military members and their households without explicit consent. It defines "data brokers" as companies that collect and sell personal data from people they don't have direct relationships with, and requires clear, affirmative consent for any sale of military-related information. The law specifically bans selling "military servicemember lists" or personal data about military members or their families without permission, applying to businesses operating in New York or targeting New York residents. It excludes certain entities like financial institutions under federal law but directly affects data brokers and military households by restricting commercial use of their personal information.
Enacts the "data economy labor compensation and accountability act"; establishes the office of consumer data protection for the purpose of properly safeguarding personal data; imposes a tax on data controllers and data processors required to register with such office.
Enacts the "connected consumer product end of life disclosure act", relating to requiring manufacturers of connected consumer products to disclose for how long they will provide technical support, security updates, or bug fixes for the software, hardware, or firmware necessary for the product to securely function.
This bill creates a two-year pilot program in New York allowing vehicle owners to use digital license plates instead of traditional metal plates. The program requires the motor vehicle commissioner to establish rules covering safety standards, privacy protections, product design, approval processes, and data security for digital plate companies. Digital plates must display registration details clearly at 100 feet and follow specific size and color limitations. The program includes a mandatory review after one year and a full report to the legislature within 18 months, after which the law expires.
This bill requires businesses to disclose when prices are set by algorithms using a customer's personal data, mandating a clear notice: "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." It also bans using protected characteristics (like race, gender, or age) to set prices for goods or services, preventing discriminatory pricing. The law applies to most businesses but excludes insurers and financial services (e.g., credit cards, loans). Violations can result in civil penalties of up to $1,000 per violation.
Creates a state office of algorithmic innovation to set policies and standards to ensure algorithms are safe, effective, fair, and ethical, and that the state is conducive to promoting algorithmic innovation.
This bill requires manufacturers selling connected devices (like smart home gadgets or wearables) in New York to include reasonable security features. It mandates that security measures must be appropriate for the device's function and the data it handles, specifically to prevent unauthorized access, hacking, or data breaches. Key provisions include requiring unique default passwords or forcing users to set new login credentials during first use. The law explicitly excludes federal-regulated devices, HIPAA-covered health devices, third-party apps, and user modifications to device software. It does not create private lawsuits but grants enforcement authority solely to the Attorney General.
Requires express and affirmative consent prior to collection, storage or transmittal of any personal information obtained from the installation or use of a smart home connected system by certain persons.
Prohibits the collection or processing of an individual's location information except for a permissible purpose; requires an entity collecting location information for the provision of multiple permissible purpose to maintain a location privacy policy obtain consent from the individual the information pertains to; prohibits the disclosure or sale of such information except for certain purposes; provides remedies for violations.
Requires social media networks to provide and maintain mechanisms for deleting individual accounts on their platform; requires social media networks to have a clear and concise policy readily available and accessible on their website and application which includes how such social media network will delete individual user accounts and all associated personal data on their platform.
