New York has no comprehensive consumer privacy statute, so obligations there come from its breach-notification law, sector-specific rules and federal statutes. This page collects our coverage touching New York. For the underlying law rather than the news, see our New York privacy law page.
Biometric Privacy
October 12, 2026
Local Law 63 of 2021 added a tenant data privacy chapter to the New York City Administrative Code for apartment buildings that use key fobs, phone apps or biometric scanners at the door. It lists the only data such a system may hold, puts 90-day clocks on keeping it, bars its sale and several surveillance uses, and gives occupants a damages action for one violation only: an unlawful sale.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Chapter 121 of the Laws of 2024 added article 39-FF, sections 899-ee to 899-mm, to New York's General Business Law. It has applied since June 20, 2025 to operators whose users are known minors or whose services are primarily directed to minors. The Attorney General issued an advance notice in 2024 and implementation guidance in May 2025, but has not published proposed rules.
Read more →
Data Security Rules
September 14, 2026
The SHIELD Act of 2019 did two things: it widened New York's breach notification statute, General Business Law section 899-aa, and it added section 899-bb, a standalone duty to maintain reasonable data security. This sets out the security requirement as enacted, the routes to deemed compliance, and the three later chapters that changed section 899-aa without touching section 899-bb.
Read more →
Workplace Monitoring
September 7, 2026
Three states condition workplace electronic monitoring on notice rather than on consent, and each builds the requirement differently. Connecticut makes a posted notice the legal notice. New York requires a notice on hiring and a posting. Delaware offers a choice between a daily electronic notice and a one-time acknowledged one.
Read more →