Status as of November 2026: New York has no comprehensive consumer privacy law. The New York Privacy Act is still a bill in the 2025–2026 session: S3044 in the Senate, which the Internet and Technology Committee reported to the Finance Committee on May 29, 2025 and which was referred back to Internet and Technology on January 7, 2026, and its Assembly same-as bill A8158, which is in the Consumer Affairs and Protection Committee. Two narrower New York privacy laws do apply: the Child Data Protection Act, in effect since June 20, 2025, and the SAFE for Kids Act, which takes effect on January 25, 2027.
For a short status summary, see our New York privacy law tracker.
Key Takeaways
- New York has not enacted the New York Privacy Act (NYPA). The current versions, S3044 and A8158, are in committee.
- Other comprehensive bills are also pending, including A4947 and the New York Data Protection Act (A974A in the Assembly, S8524 in the Senate).
- The Child Data Protection Act took effect June 20, 2025, and protects users under 18.
- The Attorney General released final SAFE for Kids Act rules on July 28, 2026. The law takes effect January 25, 2027.
New York Privacy Laws in Effect
While the NYPA remains a bill, New York has passed laws that protect minors online. Governor Kathy Hochul signed the New York Child Data Protection Act (S7695) and the SAFE for Kids Act (S7694) on June 20, 2024.
The New York Child Data Protection Act (S7695)
The Child Data Protection Act (Chapter 121 of the Laws of 2024, General Business Law Article 39-FF) took effect on June 20, 2025, one year after it was signed. It applies to operators of websites, online services and apps that process the personal data of users they know are minors, or whose service is primarily directed to minors. Key rules:
- For users under 13, processing follows the federal COPPA standards. For users aged 13 to 17, operators need informed consent unless the processing is strictly necessary for a listed purpose, such as providing a service the user requested or complying with the law.
- Businesses must delete data of minors within 30 days of learning their age unless specific exceptions apply.
- The sale of minors’ personal data is prohibited.
- Contracts with third-party vendors must reflect the rules governing minors’ data.
The Attorney General’s guidance, last updated May 19, 2025, explains how the “strictly necessary” standard will be read:
- Processing must stay within what a reasonable user of the requested service would expect, for example customer support.
- Behavioral advertising and profiling to display or prioritize content are not “strictly necessary.”
- The Attorney General will set rules on device “age flags” that operators must respect. Until those rules are final, it will use enforcement discretion for operators that make good-faith efforts to comply.
The SAFE for Kids Act (S7694)
The SAFE for Kids Act targets addictive social media feeds. The Attorney General released the final rules on July 28, 2026, and they were published in the State Register on July 29, 2026. The law takes effect on January 25, 2027, 180 days after that publication. Under the act and the rules:
- Platforms must not show algorithmically personalized feeds to users under 18 without parental consent, and must confirm that users are adults before giving them those feeds.
- Notifications to minors between 12 a.m. and 6 a.m. are restricted unless a parent consents.
- Age and consent data may be used only for that purpose and must then be deleted or de-identified.
What Businesses Should Do Now
Businesses that serve minors in New York should focus on:
- Age assurance: confirming which users are minors, and which are adults for feed access.
- Data policies: aligning collection, processing and deletion with the Child Data Protection Act.
- Contracts: making sure vendors that handle minors’ data follow the same rules.
- Feeds and notifications: preparing social media features for the SAFE for Kids Act by January 25, 2027.
2025–2026 New York Privacy Act Bills
New York continues to be one of the most active states for privacy bills, but none of the comprehensive bills has passed both chambers.
S3044 and A8158: The Current New York Privacy Act
S3044, sponsored by Senator Kristen Gonzalez, and its Assembly same-as bill A8158 are the current version of the New York Privacy Act. As written, they would apply to businesses that conduct business in New York or target New York residents and have annual gross revenue of $25 million or more, control or process the personal data of 50,000 or more consumers, or derive over 50% of gross revenue from the sale of personal data. The bills would require opt-in consent to process sensitive data, require data brokers to register, and let the Attorney General seek civil penalties of up to $20,000 per violation.
Senator Kevin Thomas, who sponsored earlier versions of the bill, is no longer in the Senate. A separate Assembly bill, A4947, is also titled the New York Privacy Act and is in the Consumer Affairs and Protection Committee.
The New York Data Protection Act (A974A and S8524)
A competing bill, the New York Data Protection Act, is pending as A974A in the Assembly and S8524 in the Senate. A974 was reported to the Codes Committee on May 27, 2025 and amended on May 29, 2026. S8524 is in the Senate Internet and Technology Committee.
History: Earlier Versions of the New York Privacy Act (2021–2024)
The sections below describe earlier versions of the bill and are kept for reference. The 2021 version (S6701, Senator Kevin Thomas) advanced to third reading in the Senate in May 2021 but did not pass, and the 2023–2024 version (S365) passed the Senate but not the Assembly. None of them became law.
Finding a balance between the need to handle personal information and protecting the privacy of individuals can be challenging. Privacy is a significant element of freedom, “to be secure… against unreasonable searches and seizures” (according to the Fourth Amendment). Privacy laws hold accountable those who steal or misuse data, and are necessary to protect privacy rights. These laws drive stronger industry standards and prioritize privacy over other objectives.
The familiarity and comfort of tailor-made online experiences and sheer convenience of having our devices anticipate our every move take on a slightly darker twist with the popular belief that “Big Tech” is trying to exploit our personal data and various governments are trying to keep tabs on us. Whether or not this is the case, state data privacy laws are taking action to help us regain our privacy and control over our information.
The NYPA is a proposed comprehensive consumer privacy law that would protect the privacy of New York residents by giving them greater control over their personal information and by holding businesses accountable.
The New York Privacy Act, advocated by Senator Kevin Thomas (D-Nassau County), passed in the New York State Senate after its third reading on June 8, 2023, and was delivered to the New York State Assembly. It died in the Assembly; an amended version (S365B) passed the Senate again on June 3, 2024, and was referred to the Assembly Consumer Affairs and Protection Committee, where it did not advance.
The 2023 bill is titled Senate Bill 365A and includes some notable provisions. We’ll review some of them below.
Key Takeaways From the New York Privacy Act
The proposed measures aim to empower consumers with greater control over their privacy and enhance accountability in data processing practices. The key provisions include:
- Mandatory Consent: Companies would be obligated to obtain explicit consent from consumers before processing their personal data. This requirement ensures that individuals have the choice and awareness regarding the use of their information.
- Transparency and Accountability: The legislation would establish robust transparency and accountability standards for businesses that handle substantial amounts of personal data. This ensures that companies are transparent about their data collection and processing practices, and are accountable for how they handle consumer information.
- Oversight of Data Brokers: The Office of the Attorney General would be granted authority to conduct oversight of data brokers. These are entities that collect personal information about consumers and sell that data to other controllers or third parties. This oversight ensures that data brokers adhere to privacy regulations and responsibly handle consumers’ personal information.
Who does it apply to?
Under the 2023–2024 version (S365B), the act would have applied to entities that conduct business in New York or target products or services to New York residents.
Those entities also had to meet at least one of these criteria:
- If your yearly gross revenue is over $25,000,000.
- If you control the data of a minimum of 100,000 New Yorkers.
- If you control the data of a minimum of 500,000 people in general, with 10,000 that are New York residents.
- If you derive over 50% of your gross revenue from the selling of personal data and control or process the data of 25,000 or more consumers.
Targeted advertising and data sellers are not the only ones who need to take heed of the upcoming laws and regulations to ensure they won’t be in violation and open to penalties. Any business or company that processes, stores, handles or uses personal information of any kind will need to adhere to these laws.
As the global market becomes more and more interconnected, businesses around the world will need to take into account the NYPA if they want New York’s residents to use their websites or services.
The current 2025–2026 bills (S3044 and A8158) use different thresholds; see the FAQ below.
Government bodies who are processing or storing data for reasons other than sales are exempt from the NYPA, as is data maintained for employment purposes, protected health information and data collected to research on human subjects. These exemptions will need to be examined in greater detail when the final version of NYPA is released.
Unique Aspects of NYPA versus Other Privacy Laws
NYPA has been noted to surpass its contemporaries, like the California Consumer Privacy Act (CCPA) and Virginia’s Consumer Data Protection Act (CDPA), in its stringencies. It is more specific than the CCPA, which has received criticism for being impractical due to its breadth and very general terms. Yet it is less broad than the GDPR.
There are plenty of common factors between the New York Privacy Act and other more established privacy laws, like Europe’s GDPR, including lawful processing, consent, individual rights to name a few.
The naming of third parties with whom a company does business is a requirement of NYPA in order to provide full transparency to consumers. The New York Privacy Act also refers to data fiduciary responsibilities. This can be compared to the GDPR’s Data Controller- the one who decides the purpose and process to handle personal data.
Earlier drafts were noted for not including a category of “sensitive data.” The current bills (S3044 and A8158) do define sensitive data, such as health, biometric and precise geolocation data, and would require opt-in consent to process it.
What happens if you don’t comply?
The NYPA is not law, so there are no penalties today. Under the current bills (S3044 and A8158), only the Attorney General could enforce the act and could seek civil penalties of not more than $20,000 per violation. Data brokers that fail to register could face a civil penalty of $1,000 per day.
Steps to The New York Privacy Act Compliance
As with all privacy laws, the best place to start is by knowing where your company touches personal data and evaluating the flow of data from inception through the completion of your service or business. Take into account not only the networks and systems within your organization, but also the vendors with whom you do business. Do they receive personal data from you? Are your compliance demands incorporated into your SLA’s (Service Level Agreements)? Ensure your vendors will not be the downfall of your compliance with vendor risk assessments.
Create a privacy notice for your customers. Scope your organization to know where personal information is to be found and ensure all aspects are covered in the privacy notice- including the rights mentioned above.
Consider using an automated risk and compliance management platform that will prepare your organization for compliance with all of the major privacy laws. Schedule a demo to see how Centraleyes cutting-edge compliance tools will boost your company’s compliance with New York’s children’s privacy laws and, if it passes, the NYPA.
Frequently Asked Questions About NYPA and Related Privacy Laws
Is the New York Privacy Act (NYPA) law in 2026?
Answer: No. As of November 2026, the NYPA has not passed either chamber. S3044 passed the Senate Internet and Technology Committee on May 27, 2025 and was sent to the Finance Committee, then was referred back to Internet and Technology on January 7, 2026. The Assembly version, A8158, is in the Consumer Affairs and Protection Committee. It is not enforceable.
Is the NYPA likely to pass?
Answer: It is uncertain. Neither chamber has passed it as of November 2026. Senator Kevin Thomas, who championed earlier versions, has been replaced as sponsor by Senator Kristen Gonzalez, and several competing bills are pending. If it does not pass in the 2025–2026 session, it would have to be reintroduced in a later session, as happened with the 2021 and 2023 versions.
Who would the NYPA apply to?
Answer: As written in S3044 and A8158, NYPA would apply to businesses that conduct business in New York or target New York residents and that:
- Have annual gross revenue of $25 million or more, or
- Control or process the personal data of 50,000 or more consumers, or
- Derive over 50% of gross revenue from the sale of personal data.
So, it’s not just targeted at tech giants; any company handling significant consumer data in New York may be affected.
What’s the difference between the Child Data Protection Act and the SAFE for Kids Act?
Answer: They’re separate laws passed together, and they address different privacy risks:
| Act | What it Regulates | Key Focus |
| Child Data Protection Act (S7695) | How data is collected and processed for users under 18 | Consent, data minimization, age flags, and data sales |
| SAFE for Kids Act (S7694) | How online platforms deliver content to minors | Algorithmic feeds, push notifications,and platform design |
If my company already follows COPPA, am I compliant with New York’s Child Privacy Law?
Answer: COPPA covers users under 13 and sets rules for parental consent. The New York law extends protections up to age 18. That means for teens aged 13–17, you’ll need informed consent or a clear, strictly necessary purpose. So, COPPA compliance is a good start, but not enough on its own.
