--------------------------- Title: New York Data Privacy Laws: What Applies to Your Website in 2026 URL: https://www.cookiebot.com/us/new-york-data-privacy-law/ --------------------------- # New York Data Privacy Laws: What Applies to Your Website in 2026 ## At a Glance - New York doesn’t currently have a comprehensive consumer privacy law, but several privacy and data protection laws may apply to businesses handling New York state residents’ data. - The NY SHIELD Act is already in force and requires covered businesses to protect New York state residents’ private information and comply with applicable data breach requirements. - The New York Child Data Protection Act adds specific protections for the personal data of users under 18 and has been in effect since June 2025. - The New York Privacy Act and New York Data Protection Act are proposed laws. As of September 2026, neither legislation has been enacted. - Which requirements apply to your website depends on factors such as whose data you collect and process, for what purposes, and your industry, rather than simply where your business is based. In 2026, New York doesn’t have one comprehensive consumer privacy law. Instead, businesses may need to comply with the NY SHIELD Act and other laws depending on the data they handle and who they collect it from. Meanwhile, the New York Privacy Act and New York Data Protection Act have been proposed, but remain unpassed legislation. Search for the New York data privacy law, and things get confusing quickly. There’s a variety of current laws and legislation, but they don’t all have the same legal status or apply to the same data processing, consumers, or businesses. What matters is knowing which of these laws you need to comply with now and which are still proposals. [More than 20 U.S. states](https://www.cookiebot.com/en/data-privacy-laws-us-websites/) now have comprehensive privacy laws, but New York is not yet one of them. The NY SHIELD Act is already in force, along with other laws covering specific types of data and consumers. Meanwhile, broader proposals such as the [New York Privacy Act](https://www.nysenate.gov/legislation/bills/2025/S3044) and [New York Data Protection Act](https://www.nysenate.gov/legislation/bills/2025/A8101) have not become law yet. For website owners, that distinction matters. Your business may already have obligations under New York law even without a comprehensive state privacy law in place. Learn which requirements may apply to your website. ## Does New York Have a Comprehensive Data Privacy Law? No, as of 2026, New York state does not have a comprehensive consumer data privacy law comparable to [California Consumer Privacy Act (CCPA)](https://www.cookiebot.com/us/what-is-ccpa/) or similar privacy laws enacted in a growing number of other U.S. states. At present, New York regulates data privacy through the NY SHIELD Act and the New York Child Data Protection Act. Other regulations may also apply in the future. ## What Is the NY SHIELD Act? The [New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act](https://usercentrics.com/us/knowledge-hub/new-york-shield-act/) is a data security law designed to strengthen protections for New York residents’ private information. It took effect in stages between 2019 and 2020 and expanded both the state’s data breach notification rules and its requirements for how businesses protect private information. ### Who Does the NY SHIELD Act Apply To? The NY SHIELD Act applies to any person or business that owns or licenses computerized data containing the private information of a New York resident. Since the law applies based on the data subject (New York state residents), it doesn’t matter where a business is located, only that they own or license that information. “Private information” has a specific meaning under the Act. It generally covers personal information combined with [sensitive data](https://usercentrics.com/knowledge-hub/sensitive-information-guide/) that could expose someone to harm if compromised, such as a Social Security number, financial account credentials, or certain biometric data. ### What Does the SHIELD Act Require Businesses to Do? The SHIELD Act focuses on two key responsibilities: keeping private information secure and responding appropriately when a breach occurs. Businesses that own or license private information belonging to New York residents must put reasonable administrative, technical, and physical safeguards in place to protect it. What is considered “reasonable” will depend on factors such as the size and complexity of the business operations. The Act also strengthened New York’s data breach rules. It expanded the types of private information covered and, importantly, broadened the definition of a breach. A breach can involve unauthorized access to private information, even if there is no evidence that the information was actually acquired. New York has updated its breach notification rules since the SHIELD Act was enacted. As of 2026, businesses that are required to provide notice generally must notify affected New York residents within 30 days of discovering a breach, subject to the requirements and exceptions set out in the law. ### Does the SHIELD Act Apply to Businesses Outside New York? Yes, the SHIELD Act can apply to businesses outside New York if they own or license computerized data containing the private information of New York residents. This was one of the significant changes introduced by the SHIELD Act. New York’s previous breach notification law was more limited in scope, while the SHIELD Act extended its reach to businesses outside the state. For website owners, this means that being based elsewhere in the U.S. or abroad does not automatically put your business outside the law’s scope. What matters is whether you hold private information belonging to New York residents. ## What Other New York Privacy Laws Could Apply to Your Website? The SHIELD Act is not the only New York law that can affect how businesses handle personal data. Other requirements may apply depending on factors such as whose data you collect, the type of data involved, and the industry you operate in. For website owners, one of the most important recent additions is the New York Child Data Protection Act. ### New York Child Data Protection Act The New York Child Data Protection Act took effect on June 20, 2025. It applies to covered online services that process the personal data of users they know are under 18 or that are primarily directed to children. The law limits how covered operators can process minors’ personal data. In general, processing must be necessary to provide the service requested by the user unless the operator obtains the consent required by the law. The Act also restricts the sale of minors’ personal data and its use for certain advertising purposes. For websites that are likely to be accessed by children or teenagers in New York state, these requirements are separate from the NY SHIELD Act and may affect how personal data can be collected, used, and shared. ### Other Sector-Specific and Local Privacy Requirements Other privacy and data protection requirements may apply depending on your industry and the types of information your business handles. These include: #### NYDFS Cybersecurity Regulation Financial services companies regulated by the New York Department of Financial Services (NYDFS) are subject to cybersecurity requirements designed to protect information systems and nonpublic information. #### New York City Biometric Privacy Law Certain commercial establishments in New York City that collect, retain, convert, store, or share customers’ biometric identifier information must provide prescribed notice. The law also prohibits covered businesses from selling or otherwise profiting from that information. These rules don’t apply to every website or business. Whether they do depends on factors such as your industry, whose data you process, and the types of personal information you handle. ## What Is the Proposed New York Privacy Act? The New York Privacy Act (NYPA) is proposed legislation that would create a comprehensive consumer privacy framework across the state of New York. If passed, it would give New York consumers greater control over their personal data and place broader privacy obligations on covered businesses. It’s important to note that the NYPA is not currently law. Under the proposal, consumers would have several rights over their personal data. They could access the data a business holds about them, obtain a copy, correct inaccuracies, and request deletion. The NYPA would also set rules for how businesses process and share personal data, including requirements related to transparency and consent. This would bring a much broader approach to privacy regulation in New York. The SHIELD Act is largely concerned with keeping private information secure and responding to breaches. The NYPA, by comparison, would also govern how businesses collect and use personal data in the first place. ### Who Would the New York Privacy Act (NYPA) Apply To? Under the current proposal, the NYPA would apply to businesses that operate in New York state or target products or services to New York residents, provided they meet at least one of the thresholds set out in the bill. Two versions of the NYPA are currently before the legislature, and their thresholds differ. A business would fall within scope if it meets at least one of the thresholds in the relevant bill. Senate bill (S3044): - Generates annual gross revenue of at least USD 25 million - Controls or processes the personal data of 50,000 or more New York consumers - Derives more than 50 percent of its gross revenue from selling personal data Assembly bill (A4947): - Generates annual gross revenue of at least USD 25 million - Controls or processes the personal data of 100,000 or more New York consumers - Controls or processes the personal data of 500,000 or more people nationwide, including at least 10,000 New York consumers - Derives more than 50 percent of its gross revenue from selling personal data and processes the personal data of 25,000 or more New York consumers The bills also include exemptions for certain entities and categories of data. However, these requirements would only become obligations if the legislation becomes law. ### What Is the Status of the New York Privacy Act in 2026? As of late 2026, the New York Privacy Act hasn’t become law. The current proposal was introduced as Senate Bill S3044, with Assembly Bill A8158 as its counterpart in the Assembly. The Assembly bill remains in the Consumer Affairs and Protection Committee. While businesses don’t yet have NYPA obligations, it’s worth keeping an eye on the legislation. If enacted, it would expand New York’s privacy rules beyond the security and breach requirements that form much of the current framework. ## What Is the Proposed New York Data Protection Act? The New York Data Protection Act (A974A) is another proposal that would create broader privacy protections for New York consumers. Like the New York Privacy Act, it has not become law yet. If enacted, the law would give consumers a range of rights over their personal data. These would include the ability to access, correct, and delete their data, as well as opt out of targeted advertising, the sale of personal data, and certain types of profiling. Businesses would also have to be more transparent about their data practices and obtain opt-in consent before processing sensitive data for certain purposes. For website owners, these rules could affect how they approach online advertising and data sharing, as well as the information included in privacy notices. They could also change how businesses obtain and manage consent when sensitive data is involved. ### Who Would the New York Data Protection Act Apply To? Under A974A, the law would apply to businesses that operate in New York or offer products or services targeted to New York residents, provided they meet at least one of the thresholds set out in the bill. A business would fall within scope if it meets at least one of the following: - Generates annual gross revenue of USD 25 million or more - Processes the personal data of 50,000 or more consumers - Derives more than 50 percent of its gross revenue from the sale of personal data The proposal also includes exemptions for certain entities and types of data. However, these requirements would only become obligations if the legislation becomes law. ### What Is the Status of the New York Data Protection Act in 2026? As of late 2026, A974A hasn’t become law. The bill was amended and recommitted to the New York State Assembly Codes Committee on May 29, 2026, where it currently remains. So, businesses don’t currently need to comply with A974A. ## Which New York Privacy Requirements Apply to Your Website Right Now? The New York state-level privacy requirements that apply to your website depend on whose data you collect, what data you handle, and the type of business you operate. There isn’t one New York privacy law that applies to every website, so it helps to look at each requirement separately. Start with the laws that are already in effect: - **Do you hold private information about New York residents?** — The NY SHIELD Act may apply. It requires covered businesses to maintain reasonable safeguards for private information and includes requirements for responding to qualifying data breaches. - **Do you process personal data from users under 18?** — The New York Child Data Protection Act may apply. It limits how minors’ personal data can be processed, including its use for certain advertising purposes. - **Does your business operate in a regulated industry?** — You may have additional obligations. Financial services businesses regulated by the NYDFS, for example, are subject to separate cybersecurity requirements. - **Do you collect biometric identifier information at a covered commercial establishment in New York City?** — New York City’s biometric privacy requirements may apply, including rules around notice and the use of biometric information. More than one of these laws can apply to the same business. And because the NY SHIELD Act can apply to businesses outside New York state, being located elsewhere doesn’t necessarily put your website outside the scope of New York law. ## What Website Owners Can Do Now New York state doesn’t have one privacy law that gives every website the same set of rules to follow. So, the best place to start is with what applies to your business today. Start by getting a clear picture of what data you collect via your website. Review the cookies, pixels, and other tracking technologies running on the site, including those added by third-party tools or services. You’ll want to know what they collect, where they come from, and whether they send visitor data to other companies. This is where a tool like [Cookiebot™ CMP](https://www.cookiebot.com/us/cookie-consent-solution/) can help. Its patented scanner scans your website for active cookies and trackers, making it easier to see what’s running on your site, how they’re categorized, and what your compliance gaps may be, rather than relying only on what you expect to be there. Website tracking setups can change often, and it’s easy for things to get missed. Then look at the information your website collects directly, such as through account registration, checkout, or contact forms. If any of it falls within the SHIELD Act’s definition of private information, check that you have appropriate safeguards in place to protect it. If your website or service is used by people under 18, consider whether the New York Child Data Protection Act applies. The law may limit how you can process their personal data, particularly when that processing goes beyond what’s necessary to provide the service they requested. If your website has visitors under age 13, further regulations may apply, like the federal [Children’s Online Privacy Protection Act (COPPA)](https://www.cookiebot.com/us/coppa-compliance-requirements-checklist/). Finally, monitor proposed legislation separate from the requirements already in force, and check back periodically to confirm what may come into force in the future, and when. The New York Privacy Act and New York Data Protection Act aren’t currently law, so they shouldn’t be treated as compliance obligations. Keep an eye on their progress and reassess your requirements if that changes. ## Find out what’s running on your website Scan your site for free. Understanding your privacy obligations starts with knowing what data is being collected by cookies and trackers on your site. [Start scan](https://www.cookiebot.com/us/cookie-checker/) --- ## Footer ### Products - [Cookiebot™ Consent Solution](https://www.cookiebot.com/us/cookie-consent-solution/) - [Audience Survey](https://www.cookiebot.com/us/audience-survey-add-on/) - [Usercentrics for Wix](https://www.cookiebot.com/us/cookiebot-for-wix-by-usercentrics-app/) - [Usercentrics Cookiebot plugin for WordPress](https://www.cookiebot.com/us/new-wp-cookie-plugin/) - [Cookiebot CMP for Shopify](https://www.cookiebot.com/us/cookiebot-cmp-for-shopify/) - [Cookie checker](https://www.cookiebot.com/us/cookie-checker/) - [Usercentrics products](https://usercentrics.com/us/) - [Pricing](https://www.cookiebot.com/us/pricing/) ### Regulations - [DMA (EU)](https://www.cookiebot.com/us/digital-markets-act-dma/) - [GDPR (EU)](https://www.cookiebot.com/us/gdpr/) - [CCPA (California)](https://www.cookiebot.com/us/what-is-ccpa/) - [VCDPA (Virginia)](https://www.cookiebot.com/us/virginia-vcdpa/) - [LGPD (Brazil)](https://www.cookiebot.com/us/lgpd/) - [TCF v2.4 (IAB)](https://www.cookiebot.com/us/tcf/) - [Google Consent Mode (EU)](https://www.cookiebot.com/us/cookiebot-cmp-google-consent-mode/) - [Microsoft UET Consent Mode](https://www.cookiebot.com/us/microsoft-consent-mode-cmp/) - [View all regulations](/us/regulations-and-frameworks/#united-states-state&united-states-federal) ### Partners - [Become an affiliate](https://www.cookiebot.com/us/affiliates/) - [Affiliate Login](https://app.impact.com/login.user) - [Become a partner](https://www.cookiebot.com/us/resellers/) - [Find a partner](https://www.cookiebot.com/us/cookiebot-reseller/) ### Resources - [Blog](https://www.cookiebot.com/us/blog/) - [Customer stories](https://www.cookiebot.com/us/customer-stories/) - [Customer directory](https://www.cookiebot.com/us/cookiebot-customer-directory/) - [Digital Markets Act Hub](https://www.cookiebot.com/us/digital-markets-act-dma-resources/) - [Google Consent Mode Hub](https://www.cookiebot.com/us/google-consent-mode-resources/) - [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2) - [Google Consent Audit Fixes](https://www.cookiebot.com/us/google-consent-audit-fixes/) - [Cookie Banner Cost Calculator](https://www.cookiebot.com/us/cookie-banner-pricing-calculator/) ### Company - [About us](https://www.cookiebot.com/us/about/) - [Careers](https://usercentrics.com/career/) - [Support](https://support.cookiebot.com/hc/en-us/) - [Developer documentation](https://www.cookiebot.com/us/developer/) ©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of Usercentrics A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences [Privacy Policy](https://www.cookiebot.com/us/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/us/cookie-declaration/) · [Data Processing Agreement](/us/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/us/legal-notice/) · [Accessibility Statement](/en/accessibility-statement-wcag-compliance/)