New York Privacy Policy
New York has no comprehensive privacy law as of November 2026, so a New York business has no state checklist of consumer rights to recite. What it has is a deception standard enforced by the Attorney General, a data security and breach statute that reaches any business holding New Yorkers' private information, and a 2025 law on minors' data. A privacy policy is judged mainly on whether it is true.
What New York law does to this document
No comprehensive privacy law yet
The Attorney General's guidance for businesses states that New York has yet to enact a comprehensive privacy law regulating when and how consumers can be tracked online. The proposed New York Privacy Act, S3044, remained in a Senate committee in 2026. The Governor vetoed the New York Health Information Privacy Act on December 19, 2025.
2025-2026 N.Y. Senate Bill S3044; 2025-2026 N.Y. Senate Bill S929 (vetoed)The policy must be accurate
The Attorney General's guidance says New York's consumer protection laws, which prohibit deceptive acts and practices, effectively require that a website's statements about consumer privacy be truthful and not misleading. A policy that promises an opt-out the site does not honor, or that omits tracking the site performs, falls short of that standard.
N.Y. Attorney General, Website Privacy Controls: A Guide for Business (July 2024)Reasonable safeguards under the SHIELD Act
Any person or business that owns or licenses computerized data including private information of a New York resident must develop, implement and maintain reasonable safeguards. The duty follows the data, so it applies to a business with no office in New York. A small business, defined by employee count, revenue or assets, may scale its safeguards to its size and the sensitivity of the data.
N.Y. Gen. Bus. Law § 899-bbBreach notice within 30 days
A business must notify affected New York residents within 30 days after a breach is discovered, a deadline added on December 21, 2024. It must also notify the Attorney General, the Department of State and the Division of State Police, and the Department of Financial Services if the business is a covered entity under that agency's cybersecurity rule. Medical and health insurance information became private information under the statute in March 2025.
N.Y. Gen. Bus. Law § 899-aaData of users under 18
The New York Child Data Protection Act took effect on June 20, 2025. An operator may not process the personal data of a covered user aged 13 through 17 unless processing is strictly necessary for a listed purpose or the operator has informed consent. For users 12 and under, processing must be permitted under the federal children's privacy law. The Attorney General may seek civil penalties of up to $5,000 per violation.
N.Y. Gen. Bus. Law §§ 899-ff, 899-mmBiometrics in New York City
New York has no statewide biometric privacy statute, but New York City regulates places of entertainment, retail stores and food and drink establishments. A covered establishment that collects biometric identifier information must post a clear and conspicuous sign near every customer entrance, and it may not sell or otherwise profit from that information. Customers have a private right of action.
N.Y.C. Admin. Code §§ 22-1201 to 22-1203Where people go wrong in New York
- Copying consumer-rights language written for other states into a New York policy and then not honoring it, which turns a voluntary promise into a deceptive statement.
- Using the generator's minors language unchanged: it draws its age lines at 13 and 16 and has no New York section, so it does not address General Business Law § 899-ff, which restricts processing the personal data of users under 18, and a business covered by that law has to add its own terms.
- Setting prices with an algorithm that uses a customer's personal data without the disclosure General Business Law § 349-a requires next to the price.
How the generator works
A single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors. Answer a short interview and the draft assembles as you go, with New York already set as the governing state. Download it as PDF or Word. No fee. No account.