This bill prohibits data brokers from selling the personal information of current or former military members and their households without explicit consent. It defines "data brokers" as companies that collect and sell personal data from people they don't have direct relationships with, and requires clear, affirmative consent for any sale of military-related information. The law specifically bans selling "military servicemember lists" or personal data about military members or their families without permission, applying to businesses operating in New York or targeting New York residents. It excludes certain entities like financial institutions under federal law but directly affects data brokers and military households by restricting commercial use of their personal information.
Enacts the "data economy labor compensation and accountability act"; establishes the office of consumer data protection for the purpose of properly safeguarding personal data; imposes a tax on data controllers and data processors required to register with such office.
Establishes the "secure our data act"; relates to cybersecurity protection by state entities; requires the office of information technology services to develop standards for data protection of state entity-maintained information.
This bill requires businesses to disclose when prices are set by algorithms using a customer's personal data, mandating a clear notice: "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." It also bans using protected characteristics (like race, gender, or age) to set prices for goods or services, preventing discriminatory pricing. The law applies to most businesses but excludes insurers and financial services (e.g., credit cards, loans). Violations can result in civil penalties of up to $1,000 per violation.
Requires express and affirmative consent prior to collection, storage or transmittal of any personal information obtained from the installation or use of a smart home connected system by certain persons.
Prohibits the collection or processing of an individual's location information except for a permissible purpose; requires an entity collecting location information for the provision of multiple permissible purpose to maintain a location privacy policy obtain consent from the individual the information pertains to; prohibits the disclosure or sale of such information except for certain purposes; provides remedies for violations.
Requires social media networks to provide and maintain mechanisms for deleting individual accounts on their platform; requires social media networks to have a clear and concise policy readily available and accessible on their website and application which includes how such social media network will delete individual user accounts and all associated personal data on their platform.
Establishes the "It's Your Data Act" for the purposes of providing protections and transparency in the collection, use, retention, and sharing of personal information.
This bill requires companies selling voice-enabled devices (like smart speakers, TVs, or children's toys) to clearly inform users during setup that the device may record voice data. It bans companies from selling or using these voice recordings for advertising, whether the recordings are collected by the device manufacturer or a third party. The law also protects manufacturers from liability for third-party apps users choose to install. Violations can result in fines up to $2,500 per incident, enforced by New York's Attorney General. The bill directly affects device manufacturers and users of voice-recognition technology in New York.
Establishes the biometric identifier privacy act; requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first.
