New York S 6867: Relates to the sale of personal information by an internet service provider

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S06867 Summary:

BILL NOS06867 

&nbsp

SAME ASNo Same As

&nbsp

SPONSORWEBB

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Add §349-h, Gen Bus L

&nbsp

Relates to the sale of personal information by an internet service provider.

Go to top S06867 Actions:

BILL NOS06867 

&nbsp

03/25/2025REFERRED TO CONSUMER PROTECTION

01/07/2026REFERRED TO CONSUMER PROTECTION

Go to topS06867 Committee&nbspVotes:

Go to topS06867 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS06867 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 6867

 2025-2026 Regular Sessions

 IN SENATE

 March 25, 2025
 ___________

 Introduced by Sen. WEBB -- read twice and ordered printed, and when
 printed to be committed to the Committee on Consumer Protection

 AN ACT to amend the general business law, in relation to the sale of
 personal information by an internet service provider

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. The general business law is amended by adding a new section
 2 349-h to read as follows:
 3 § 349-h. Sale, transfer, or sharing of personal information by an
 4 internet service provider. 1. As used in this section:
 5 (a) "Personal information" shall mean any information that, when it is
 6 disclosed, identifies, describes, or is able to be associated with an
 7 individual and includes, but is not limited to, the following:
 8 (i) an individual's name and address;
 9 (ii) information pertaining to creditworthiness, assets, income or
 10 liabilities;
 11 (iii) age or date of birth;
 12 (iv) names of children;
 13 (v) electronic mail or other addresses of children;
 14 (vi) number of children;
 15 (vii) the age or gender of children;
 16 (viii) height;
 17 (ix) weight;
 18 (x) race;
 19 (xi) religion;
 20 (xii) occupation;
 21 (xiii) telephone number;
 22 (xiv) education;
 23 (xv) political party affiliation;
 24 (xvi) medical condition;
 25 (xvii) drugs, therapies, or medical products or equipment used;

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD09413-01-5

 S. 6867 2

 1 (xviii) the kind of product the customer purchased, leased, or rented;
 2 (xix) real property purchased, leased, or rented;
 3 (xx) the kind of service provided;
 4 (xxi) social security number;
 5 (xxii) bank account number;
 6 (xxiii) credit card number;
 7 (xxiv) debit card number;
 8 (xxv) bank or investment account, debit card, or credit card balance;
 9 (xxvi) payment history;
 10 (xxvii) internet searches; or
 11 (xxviii) browser cache.
 12 (b) "Provider of internet service" shall mean any person, business or
 13 organization qualified to do business in this state that provides indi-
 14 viduals, corporations, or other entities with the ability to connect to
 15 the internet through equipment that is located in this state.
 16 2. A provider of internet service shall keep confidential:
 17 (a) all personal information concerning a subscriber, other than the
 18 electronic mail address of the subscriber, unless the subscriber gives
 19 permission, in writing or by electronic mail, to the provider of inter-
 20 net service to disclose the information; and
 21 (b) the electronic mail address of a subscriber, if the subscriber
 22 requests, in writing or by electronic mail, to have the electronic mail
 23 address of the subscriber kept confidential. Upon receiving such a
 24 request from a subscriber, a provider of internet service shall keep
 25 confidential the electronic mail address of the subscriber, unless the
 26 subscriber gives permission, in writing or by electronic mail, to the
 27 provider of internet service to disclose the electronic mail address of
 28 the subscriber.
 29 3. A provider of internet service shall provide notice of the require-
 30 ments of subdivision two of this section to each of its subscribers. The
 31 notice must include, without limitation, a conspicuous statement that a
 32 subscriber may request, in writing or by electronic mail, to have the
 33 electronic mail address of the subscriber kept confidential.
 34 4. A provider of internet service shall not add a supplemental charge
 35 or in any way penalize a subscriber either financially or