New York S 9672: Restricts the disclosure of personal information by businesses

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S09672 Summary:

BILL NOS09672 

&nbsp

SAME ASSAME AS A00257

&nbsp

SPONSORMAY

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Amd Art 39-F Art Head, add §899-cc, Gen Bus L

&nbsp

Restricts the disclosure of personal information by businesses; provides that a business that retains a customer's personal information shall make available to the customer free of charge access to, or copies of, all of the customer's personal information retained by the business.

Go to top S09672 Actions:

BILL NOS09672 

&nbsp

04/01/2026REFERRED TO CONSUMER PROTECTION

Go to topS09672 Committee&nbspVotes:

Go to topS09672 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS09672 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 9672

 IN SENATE

 April 1, 2026
 ___________

 Introduced by Sen. MAY -- read twice and ordered printed, and when
 printed to be committed to the Committee on Consumer Protection

 AN ACT to amend the general business law, in relation to restricting the
 disclosure of personal information by businesses

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. This act shall be known and may be cited as the "right to
 2 know act".
 3 § 2. The legislature hereby finds and declares that the right to
 4 privacy is a personal and fundamental right protected by the United
 5 States Constitution. All individuals have a right of privacy in informa-
 6 tion pertaining to them.
 7 This state recognizes the importance of providing consumers with tran-
 8 sparency about how their personal information has been shared by busi-
 9 nesses. For free market forces to have a role in shaping the privacy
 10 practices and for "opt-in" and "opt-out" remedies to be effective,
 11 consumers must be more than vaguely informed that a business might share
 12 personal information with third parties. Consumers must be better
 13 informed about what kinds of personal information are purchased by busi-
 14 nesses for direct marketing purposes. With these specifics, consumers
 15 can knowledgeably choose to opt-in or opt-out or choose among businesses
 16 that disclose information to third parties for direct marketing purposes
 17 on the basis of how protective the business is of consumers' privacy.
 18 Businesses are now collecting personal information and sharing and
 19 selling it in ways not contemplated or properly covered by the current
 20 law. Some web sites are installing up to one hundred tracking tools when
 21 consumers visit web pages and sending very personal information such as
 22 age, gender, race, income, health concerns, and recent purchases to
 23 third-party advertising and marketing companies. Third-party data broker
 24 companies are buying, selling, and trading personal information obtained
 25 from mobile phones, financial institutions, social media sites, and
 26 other online and brick and mortar companies.

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD01360-01-5

 S. 9672 2

 1 Some mobile applications are sharing personal information, such as
 2 location information, unique phone identification numbers, and age,
 3 gender, and other personal details with third-party companies.
 4 Consumers need to know the ways that their personal information is
 5 being collected by companies and then shared or sold to third parties in
 6 order to properly protect their privacy, personal safety, and financial
 7 security.
 8 § 3. The article heading of article 39-F of the general business law,
 9 as amended by chapter 117 of the laws of 2019, is amended to read as
 10 follows:
 11 [NOTIFICATION OF UNAUTHORIZED] ACQUISITION AND USE
 12 OF PRIVATE
 13 INFORMATION; DATA SECURITY PROTECTIONS
 14 § 4. The general business law is amended by adding a new section 899-
 15 cc to read as follows:
 16 § 899-cc. Disclosure of a customer's personal information to a third
 17 party. 1. (a) A business that retains a customer's personal information
 18 shall make available to the customer free of charge access to, or copies
 19 of, all of the customer's personal information retained by the business.
 20 (b) A business that discloses a customer's personal information to a
 21 third pa