Cybersecurity Policy Report, New York Assembly Committee Advances Proposed Data Protection Act, (Jun 1, 2026)
The New York state Assembly Consumer Committee voted 15-0 to pass a bill that would require companies to obtain consent from consumers before processing their personal data.
The New York Data Protection Act (AB 974A) seeks to give consumers more control over their personal data, including notice of how their data is being processed and sold, the right to opt out, the right to opt in for sensitive data, the ability to request access and obtain a copy of their data in a commonly used electronic format, and the ability to request the correction of inaccurate data and deletion of data.
The provisions would apply to businesses meeting specific thresholds such as $25 million in annual revenue, processing data of at least 100,000 consumers, or deriving more than 50% of revenue from data sales, but it would exempt government entities, certain financial and educational data regulated by federal law, and some nonprofit and research activities.
The bill would give the state attorney general enforcement authority and would empower the AG to seek injunctions, restitution, disgorgement, and civil penalties of up to $20,000 per violation, with each instance of unlawful processing and each affected consumer constituting a separate violation. The attorney general would be empowered to issue subpoenas, conduct investigations, and promulgate regulations to implement the bill’s provisions.
Rep. Nily Rozic (D.) is sponsoring the bill (A.B. 974, Reg Sess.).
News: StateLegislation DataPrivacy