New York Data Privacy Law: Breach Rules, AI Laws and Algorithmic Pricing (2026)
Short answerPartly. New York has no single consumer privacy statute, but several laws protect data: General Business Law § 899-aa requires breach notice within 30 days, § 899-bb requires reasonable safeguards, and § 349-a requires algorithmic pricing disclosures. The Attorney General enforces them.
Last verified: November 2, 2026 against General Business Law §§ 349-a, 899-aa and 899-bb and bill S8828 on nysenate.gov
What is the New York data privacy law? There is no one statute with that name. New York protects personal data through a set of separate laws on breaches, security safeguards, pricing algorithms, artificial intelligence and children’s data, and the rules that apply to you depend on who holds your data and what they do with it.
Key facts
- Breach notice: affected New Yorkers must be told within 30 days of discovery.
- Safeguards: the SHIELD Act requires reasonable security for private information.
- Pricing: sellers must label prices set by an algorithm using your personal data, since November 10, 2025.
- AI: the RAISE Act covers large frontier AI developers starting January 1, 2027.
- Enforcement: the Attorney General brings these cases, and the breach and SHIELD laws give you no right to sue.
- Not law: the New York Health Information Privacy Act was vetoed in December 2025.
Is there a New York data privacy law for consumers?
Not one that matches the broad consumer privacy acts passed in some other states. We found no New York statute that gives every resident a general right to access, delete or opt out of the sale of their data. Instead, the state regulates specific situations. This table shows where each rule lives.
| Topic | Law | Who enforces it |
|---|---|---|
| Data breach notice | General Business Law § 899-aa | Attorney General |
| Security safeguards (SHIELD Act) | General Business Law § 899-bb | Attorney General |
| Algorithmic pricing | General Business Law § 349-a | Attorney General |
| Frontier AI models (RAISE Act) | General Business Law Article 44-B | Attorney General and a new office in the Department of Financial Services |
| AI hiring tools in New York City | Local Law 144 of 2021 | NYC Department of Consumer and Worker Protection |
| Children’s data | Child Data Protection Act, General Business Law § 899-ff | Attorney General |
New York data breach notification law
A business that suffers a breach of New Yorkers’ private information must notify those residents within 30 days after discovering the breach. The statute is General Business Law § 899-aa, and it also says notice must come in the most expedient time possible and without unreasonable delay. A vendor that holds data for another company must tell that company within 30 days of discovery too.
The business must also notify the Attorney General, the Department of State and the State Police. If it is a covered entity under 23 NYCRR 500.1, it must notify the Department of Financial Services as well. If more than 5,000 New York residents must be told at one time, it must notify the consumer reporting agencies.
The 30-day deadline, the Department of Financial Services notice and the addition of medical and health insurance information to the definition of private information came from amendments signed in December 2024. A chapter amendment in February 2025 clarified that the Department of Financial Services notice applies only to covered entities.
If a business knowingly or recklessly violates the notice rules, a court may impose a civil penalty of the greater of $5,000 or up to $20 per failed notification, capped at $250,000 for that portion. Only the Attorney General can bring the case.
The SHIELD Act: reasonable safeguards
Any business that owns or licenses private information of New York residents must develop, implement and maintain reasonable safeguards under General Business Law § 899-bb. Businesses already regulated under federal banking, health privacy or Department of Financial Services cybersecurity rules are treated as compliant if they follow those rules.
Small businesses get a scaled-down standard. The statute defines a small business as one with fewer than 50 employees, under $3 million in gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets. A violation is treated as a violation of General Business Law § 349, and the statute says it creates no private right of action.
New York algorithmic pricing law
Since November 10, 2025, a business that sets a price using personalized algorithmic pricing and shows it to a New York consumer must display this exact notice: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.” The rule is in General Business Law § 349-a, and the notice must be clear and conspicuous, shown with or near the price.
The law exempts insurance pricing, certain financial institutions, and a price for an existing subscription that is lower than the contract price. The Attorney General can send a cease-and-desist letter with a time to fix the problem, then seek an injunction. The civil penalty is up to $1,000 for each violation.
The National Retail Federation challenged the law on First Amendment grounds. On October 8, 2025, a federal court in the Southern District of New York rejected the challenge. Enforcement had been paused while the case was pending, and the law took effect on November 10, 2025.
New York AI laws: the RAISE Act
There is no statewide New York AI ban. The state’s main AI statute is the RAISE Act, which focuses on transparency and safety reporting for the largest developers. Governor Hochul signed it on December 19, 2025, and a chapter amendment, Chapter 96 of the Laws of 2026, was signed on March 27, 2026. The law takes effect January 1, 2027.
- Who it covers: developers of frontier models trained with more than 10^26 operations. Large frontier developers are those with annual gross revenue above $500 million, including affiliates.
- What they must do: publish a frontier AI framework, review it every year and publish a transparency report with each deployment.
- Incident reporting: report a safety incident within 72 hours, or within 24 hours if there is an imminent risk of death or serious physical injury.
- Penalties: up to $1 million for a first violation and up to $3 million for later ones, enforced by the Attorney General. The original bill had $10 million and $30 million.
- Oversight: a new office within the Department of Financial Services.
New York City rules: Local Law 144 and AI hiring
New York City adds its own rule for employers. Local Law 144 of 2021 regulates automated employment decision tools used to screen candidates or employees who live in the city. Enforcement by the Department of Consumer and Worker Protection began on July 5, 2023.
- The tool must have had an independent bias audit within one year before use, and the audit summary must be posted publicly.
- Candidates and employees must get notice at least 10 business days before the tool is used.
- Civil penalties are up to $500 for a first violation and $500 to $1,500 for each later violation, and each day a noncompliant tool is used counts as a separate violation.
On December 2, 2025, the State Comptroller reported that the city’s enforcement was weak. Auditors found 17 instances of potential non-compliance where the Department had found one, and only three of 12 test calls to 311 reached the right office. For general employee rights, see New York labor laws.
Children’s data and health data
The Child Data Protection Act limits how online services handle data about users under 18 that the operator knows are minors, or that use a service aimed at minors. For users 13 and older, processing must be strictly necessary or based on informed consent. Operators generally cannot buy or sell a covered minor’s personal data, and they must delete it within 30 days after learning the user is covered, unless an exception applies.
Health data is a different story. The Legislature passed the New York Health Information Privacy Act, but Governor Hochul vetoed it in December 2025, saying its definitions and scope were broad. It is not law.
Myths vs facts
| Myth | Fact |
|---|---|
| New York has a privacy act like California’s. | No general consumer privacy act has been enacted. |
| You can sue a company for a data breach under the SHIELD Act. | The statute creates no private right of action, and only the Attorney General sues. |
| New York banned AI. | The state regulates AI through disclosure and reporting rules, not a ban. |
| The algorithmic pricing law was struck down. | A federal court rejected the challenge in October 2025. |
Timeline of key changes
- July 5, 2023: enforcement of New York City Local Law 144 begins.
- December 2024: the breach law gains the 30-day deadline and Department of Financial Services notice.
- October 8, 2025: a federal court rejects the challenge to the algorithmic pricing law.
- November 10, 2025: the Algorithmic Pricing Disclosure Act takes effect.
- December 2, 2025: the State Comptroller audit of Local Law 144 enforcement is released.
- December 19, 2025: the RAISE Act is signed. The health privacy bill is vetoed in the same month.
- March 27, 2026: the RAISE chapter amendment is signed.
- January 1, 2027: the RAISE Act takes effect.
What to do if your data was breached
- Read the notice and note which types of information were exposed.
- Freeze your credit with the three major credit bureaus.
- Change passwords for any affected accounts.
- File a complaint with the Attorney General’s office if you think the notice was late or missing.
For related consumer topics, see the Money, Business and Consumer section, and our page on recording conversations in New York.
Frequently asked questions
Does New York have a privacy law like California’s?
No. New York has not enacted a general consumer privacy law that gives residents broad access, deletion and opt-out rights. It regulates specific areas instead, including breaches, security safeguards, algorithmic pricing, AI developers and children’s data.
How fast must a company report a data breach in New York?
Within 30 days after discovering the breach, and without unreasonable delay. It must also notify the Attorney General, the Department of State and the State Police, plus the Department of Financial Services if it is a covered entity.
What is New York’s algorithmic pricing disclosure law?
A rule in General Business Law § 349-a requiring a notice when a price is set by an algorithm using your personal data. The wording is “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA,” and the penalty is up to $1,000 per violation.
Is there a New York AI ban?
No. New York has no statewide ban on AI. It uses disclosure and reporting rules, such as the RAISE Act for large frontier developers and the New York City bias audit rule for hiring tools.
What is the NYC Local Law 144 rule on AI hiring?
Employers using automated tools to screen city candidates or employees must have an independent bias audit, post a summary and give 10 business days’ notice. The Department of Consumer and Worker Protection enforces it.
Can I sue over a data breach in New York?
The breach notice and SHIELD statutes give you no private right of action, so the Attorney General brings those cases. A lawyer can tell you whether other claims, such as negligence, fit your situation.
What changed on this page
- November 2, 2026: Published after checking the breach, SHIELD, algorithmic pricing and RAISE Act texts. See our corrections policy if you spot an error.
If this affects you
To report a breach or a pricing notice problem, contact the New York Attorney General’s consumer frauds bureau. For a legal question about your own case, the New York State Bar Association lawyer referral service can connect you with a New York-licensed attorney. Our editorial policy explains how we research these pages. This article is general legal information, not legal advice.
