New York S 9088: Requires the registration of data brokers and establishing a data deletion mechanism for consumers

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S09088 Summary:

BILL NOS09088A

&nbsp

SAME ASSAME AS A09642-A

&nbsp

SPONSORGONZALEZ

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Add Art 42-A §§1150 - 1158, Gen Bus L

&nbsp

Requires the registration of data brokers; imposes regulations upon data brokers; establishes a data deletion mechanism for consumers; imposes penalties upon data brokers for violations of the law.

Go to top S09088 Actions:

BILL NOS09088A

&nbsp

01/30/2026REFERRED TO CONSUMER PROTECTION

05/29/2026AMEND AND RECOMMIT TO CONSUMER PROTECTION

05/29/2026PRINT NUMBER 9088A

06/03/2026COMMITTEE DISCHARGED AND COMMITTED TO RULES

06/03/2026ORDERED TO THIRD READING CAL.1644

06/03/2026PASSED SENATE

06/03/2026DELIVERED TO ASSEMBLY

06/04/2026referred to consumer affairs and protection

Go to topS09088 Committee&nbspVotes:

Go to topS09088 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS09088 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 9088--A

 IN SENATE

 January 30, 2026
 ___________

 Introduced by Sen. GONZALEZ -- read twice and ordered printed, and when
 printed to be committed to the Committee on Consumer Protection --
 committee discharged, bill amended, ordered reprinted as amended and
 recommitted to said committee

 AN ACT to amend the general business law, in relation to requiring the
 registration of data brokers and establishing a data deletion mech-
 anism for consumers

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. The general business law is amended by adding a new article
 2 42-A to read as follows:
 3 ARTICLE 42-A
 4 DATA BROKERS
 5 Section 1150. Definitions.
 6 1151. Registration of data brokers.
 7 1152. Data deletion mechanism.
 8 1153. Audit.
 9 1154. Data broker website disclosure requirements.
 10 1155. Data brokers; comprehensive information security program.
 11 1156. Rulemaking.
 12 1157. Enforcement.
 13 1158. Exemptions.
 14 § 1150. Definitions. The following definitions apply throughout this
 15 article unless the context clearly requires otherwise:
 16 1. "Artificial intelligence system or model" means an artificial
 17 intelligence that can generate derived synthetic content, including
 18 text, images, video, and audio, that emulates the structure and charac-
 19 teristics of the system's training data.
 20 2. "Aggregate consumer information" means information that relates to
 21 a group or category of consumers, from which individual consumer identi-
 22 ties have been removed, that is not linked or reasonably linkable to any
 23 consumer or household, including via a device. The term "aggregate
 24 consumer information" shall not include one or more individual consumer
 25 records that have been deidentified.

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD14455-04-6

 S. 9088--A 2

 1 3. "Biometric data" means an individual's physiological, biological,
 2 or behavioral characteristics, including information pertaining to an
 3 individual's deoxyribonucleic acid (DNA), that can be used or is
 4 intended to be used singly or in combination with each other or with
 5 other identifying data, to establish individual identity. The term
 6 "biometric information" includes, but is not limited to, imagery of the
 7 iris, retina, fingerprint, face, hand, palm, vein patterns, and voice
 8 recordings, from which an identifier template, such as a faceprint, a
 9 minutiae template, or a voiceprint, can be extracted, and keystroke
 10 patterns or rhythms, gait patterns or rhythms, and sleep, health, or
 11 exercise data that contain identifying information. "Biometric data"
 12 does not include a digital or physical photograph, an audio or video
 13 recording, or any data generated from a digital or physical photograph,
 14 or an audio or video recording, unless such data is generated to identi-
 15 fy a specific individual.
 16 4. "Business" means:
 17 (a) A sole proprietorship, partnership, limited liability company,
 18 corporation, association, or other legal entity, that collects consum-
 19 ers' personal information, or on the behalf of which such information is
 20 collected and that alone, or jointly with others, determines the
 21