New York A 9642: Requires the registration of data brokers and establishing a data deletion mechanism for consumers

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
A09642 Summary:

BILL NOA09642A

&nbsp

SAME ASSAME AS S09088-A

&nbsp

SPONSORTorres

&nbsp

COSPNSRSimon

&nbsp

MLTSPNSR

&nbsp

Add Art 42-A §§1150 - 1158, Gen Bus L

&nbsp

Requires the registration of data brokers; imposes regulations upon data brokers; establishes a data deletion mechanism for consumers; imposes penalties upon data brokers for violations of the law.

Go to top A09642 Actions:

BILL NOA09642A

&nbsp

01/21/2026referred to consumer affairs and protection

06/01/2026amend and recommit to consumer affairs and protection

06/01/2026print number 9642a

Go to topA09642 Committee&nbspVotes:

Go to topA09642 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topA09642 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 9642--A

 IN ASSEMBLY

 January 21, 2026
 ___________

 Introduced by M. of A. TORRES, SIMON -- read once and referred to the
 Committee on Consumer Affairs and Protection -- committee discharged,
 bill amended, ordered reprinted as amended and recommitted to said
 committee

 AN ACT to amend the general business law, in relation to requiring the
 registration of data brokers and establishing a data deletion mech-
 anism for consumers

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. The general business law is amended by adding a new article
 2 42-A to read as follows:
 3 ARTICLE 42-A
 4 DATA BROKERS
 5 Section 1150. Definitions.
 6 1151. Registration of data brokers.
 7 1152. Data deletion mechanism.
 8 1153. Audit.
 9 1154. Data broker website disclosure requirements.
 10 1155. Data brokers; comprehensive information security program.
 11 1156. Rulemaking.
 12 1157. Enforcement.
 13 1158. Exemptions.
 14 § 1150. Definitions. The following definitions apply throughout this
 15 article unless the context clearly requires otherwise:
 16 1. "Artificial intelligence system or model" means an artificial
 17 intelligence that can generate derived synthetic content, including
 18 text, images, video, and audio, that emulates the structure and charac-
 19 teristics of the system's training data.
 20 2. "Aggregate consumer information" means information that relates to
 21 a group or category of consumers, from which individual consumer identi-
 22 ties have been removed, that is not linked or reasonably linkable to any
 23 consumer or household, including via a device. The term "aggregate
 24 consumer information" shall not include one or more individual consumer
 25 records that have been deidentified.

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD14455-05-6

 A. 9642--A 2

 1 3. "Biometric data" means an individual's physiological, biological,
 2 or behavioral characteristics, including information pertaining to an
 3 individual's deoxyribonucleic acid (DNA), that can be used or is
 4 intended to be used singly or in combination with each other or with
 5 other identifying data, to establish individual identity. The term
 6 "biometric information" includes, but is not limited to, imagery of the
 7 iris, retina, fingerprint, face, hand, palm, vein patterns, and voice
 8 recordings, from which an identifier template, such as a faceprint, a
 9 minutiae template, or a voiceprint, can be extracted, and keystroke
 10 patterns or rhythms, gait patterns or rhythms, and sleep, health, or
 11 exercise data that contain identifying information. "Biometric data"
 12 does not include a digital or physical photograph, an audio or video
 13 recording, or any data generated from a digital or physical photograph,
 14 or an audio or video recording, unless such data is generated to identi-
 15 fy a specific individual.
 16 4. "Business" means:
 17 (a) A sole proprietorship, partnership, limited liability company,
 18 corporation, association, or other legal entity, that collects consum-
 19 ers' personal information, or on the behalf of which such information is
 20 collected and that alone, or jointly with others, determines the
 21 purposes and means of the processing of consumers' personal information,
 22 that does business in the state of New York, and that satisfies one or
 23 more of the following thresholds:
 24 (i) as of Janu