A08149 Summary:
| BILL NO | A08149A |
| SAME AS | SAME AS S07695-B |
| SPONSOR | Rozic |
| COSPNSR | Reyes, Shimsky, Magnarelli, Hevesi, Buttenschon, Fahy, Dickens, McMahon, Glick, De Los Santos, Durso, McDonough, Gandolfo, Simon, Zaccaro, DeStefano, Wallace, Berger, Burdick, Seawright, McDonald, Beephan, Smullen, Manktelow, Giglio JA, Slater, Ardila, Sillitti, Darling, Brown K, Epstein, Levenberg, Weprin, Bichotte Hermelyn, Lupardo, Mikulin, Paulin, Solages, Santabarbara, Rosenthal L, Davila, Burgos, Chandler-Waterman, Taylor, Zebrowski, Jensen, Kim, Rivera, Zinerman, Maher, Walker, Cunningham, Conrad, Clark, Jackson, Dais, Rajkumar, Fall, Lunsford, Forrest, Lee, Gibbs, Anderson, Lavine, Stern, Braunstein, Dinowitz, Jean-Pierre, Septimo, Kelles, Carroll, Mamdani, Hunter, Barrett, Bronson, Pheffer Amato, O'Donnell, Cook, Gunther, Burke, Aubry, Jones, Stirpe, Sayegh, Raga, Gallahan, Tapia, Thiele, Gallagher, Alvarez, Simone, Eichenstein, Pretlow, Morinello, Shrestha, Eachus, Meeks, Jacobson, Brabenec, Blumencranz, Colton, Norris, Otis, Steck, Tannousis, Walsh |
| MLTSPNSR | Gonzalez-Rojas, Woerner |
| Add Art 39-FF §§899-ee - 899-mm, Gen Bus L | |
| Establishes the New York child data protection act to protect minors from having their personal data accessed; provides exceptions in certain circumstances. | |
A08149 Memo:
Go to topNEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
submitted in accordance with Assembly Rule III, Sec 1(f)
TITLE OF BILL: An act to amend the general business law, in relation to establishing the New York child data protection act PURPOSE: The purpose of this bill is to protect the privacy of children and young adults by restricting digital services from collecting or using the personal data of users they know are under the age of 18 without consent, and requiring safeguards for the sale or disclosure of the personal data of users they know are under the age of 18. SUMMARY OF SPECIFIC PROVISIONS: Section 1 creates a new article 39-FF titled The New York Child Data Protection Act. The article prohibits online sites from collecting, using, sharing, or otherwise processing any personal data of individuals under the age of 18 without informed consent. It also prohibits disclos- ing any data of minors to third parties unless there is a written bind- ing agreement. This act covers conduct that occurs wholly or partly in New York State and authorizes the Attorney General to bring proceedings or special actions when online platforms violate this law. Section 2 provides a severability clause. Section 3 provides the effective date. JUSTIFICATION: Children now live much of their lives online. They learn online, social- ize online, and shop online. They make mistakes online, and they discov- er who they are online. Right now, there's nothing stopping websites or other digital services from monitoring every minute detail of our chil- dren's online lives, creating profiles of every decision our children make or avoid. This information can be used against our children's interests, including by precisely crafting and targeting advertisements children are uniquely ill-suited to resist, or by haunting children with records of teenage experiences as they move from childhood to adulthood. Children should be able to freely experience the online world without concern of omnipresent monitoring and recording. They should be free to be children, without needing to second guess the long term consequences of every decision. This bill will help children in New York to have that experience again, through two main provisions: First, this bill will require privacy be the rule, not the exception. If a digital service knows a user is a minor or the service is primarily directed to minors, it will default to only being able to use that child's data in ways that are strictly necessary to provide the service. It won't be able to sell that data, or use it in ways that the user-or user's parents, for children under thirteen-don't affirmatively say that they want. Second, once information has seeped into the larger ecosystem it can be almost impossible to track down and remove, so this bill will require that digital services that use third-party service providers contractu- ally restrict those third parties from using the personal data of minors except for specified purposes, with accompanying safeguards to ensure compliance. This bill ensures that while children's privacy is protected, it does not require age verification. It requires, however, digital services to respect browser or device signals that a user is a minor, which will help parents and teens browse the internet without restrictions while preserving their privacy. PRIOR LEGISLATIVE HISTORY: This is a new bill. FISCAL IMPACTS: This bill has minimal fiscal impacts on the State or localities. EFFECTIVE DATE: Effective one year after the bill is signed into law.