New York S 9131: Relates to data broker regulation

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S09131 Summary:

BILL NOS09131 

&nbsp

SAME ASNo Same As

&nbsp

SPONSORGONZALEZ

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Add Art 42-A §§1200 - 1204, Gen Bus L

&nbsp

Relates to data broker regulation; prohibits the acquisition of personally identifiable information through fraudulent means; requires a data broker to develop, implement, and maintain a comprehensive information security program; requires data brokers operating in the state of New York to register with the attorney general.

Go to top S09131 Actions:

BILL NOS09131 

&nbsp

02/05/2026REFERRED TO INTERNET AND TECHNOLOGY

Go to topS09131 Committee&nbspVotes:

Go to topS09131 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS09131 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 9131

 IN SENATE

 February 5, 2026
 ___________

 Introduced by Sen. GONZALEZ -- read twice and ordered printed, and when
 printed to be committed to the Committee on Internet and Technology

 AN ACT to amend the general business law, in relation to data broker
 regulation

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. The general business law is amended by adding a new article
 2 42-A to read as follows:
 3 ARTICLE 42-A
 4 DATA BROKER REGULATION
 5 Section 1200. Definitions.
 6 1201. Acquisition of personally identifiable information; prohi-
 7 bition.
 8 1202. Data brokers; comprehensive information security program.
 9 1203. Data brokers; registration.
 10 1204. Enforcement; civil penalties.
 11 § 1200. Definitions. As used in this article, unless the context
 12 requires a different meaning:
 13 1. "Artificial intelligence system" means any machine learning-based
 14 system that, for any explicit or implicit objective, infers from the
 15 inputs such system receives how to generate outputs, including content,
 16 decisions, predictions, and recommendations, that can influence physical
 17 or virtual environments. "Artificial intelligence system" does not
 18 include any artificial intelligence system or general purpose artificial
 19 intelligence model that is used for development, prototyping, and
 20 research activities before such artificial intelligence system or gener-
 21 al purpose artificial intelligence model is made available to deployers
 22 or consumers.
 23 2. "Biometric data" means data generated by automatic measurements of
 24 an individual's biological characteristics, such as a fingerprint,
 25 voiceprint, eye retinas, irises, or other unique biological patterns or
 26 characteristics that is used to identify a specific individual. "Biome-
 27 tric data" does not include a physical or digital photograph, a video or
 28 audio recording or data generated therefrom, or information collected,

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD14643-02-6

 S. 9131 2

 1 used, or stored for health care treatment, payment, or operations under
 2 HIPAA.
 3 3. "Business" means a corporation, partnership, sole proprietorship,
 4 firm, enterprise, franchise, association, trust or foundation, or any
 5 other individual or entity carrying on a business or profession, whether
 6 or not for profit. "Business" does not include a state or local agency.
 7 4. "Consumer" means a natural person who is a resident of the state of
 8 New York acting only in an individual or household context. "Consumer"
 9 does not include a natural person acting in a commercial or employment
 10 context.
 11 5. "Data broker" means a business that knowingly collects and conducts
 12 the sale of personally identifiable information to third parties. The
 13 following activities conducted by a business, and the collection and
 14 sale or licensing of personally identifiable information incidental to
 15 conducting these activities, do not qualify the business as a "data
 16 broker":
 17 (a) providing 411 directory assistance or directory information
 18 services, including name, address, and telephone number, on behalf of or
 19 as a function of a telecommunications carrier;
 20 (b) providing publicly available information related to a consumer's
 21 business or profession; or
 22 (c) providing publicly available info