New York Privacy Act Effective Date and Current Status

The New York Privacy Act has no effective date because it is not law. The current version, Senate Bill S3044, is still in committee in the 2025–2026 legislative session. If the legislature passes it and the governor signs it, the bill takes effect “immediately” on signing, but most of its substantive requirements, including consumer rights, business duties, data broker registration, and enforcement, would not kick in until one year after enactment.¹ So a signing in, say, July 2026 would push the real compliance deadline to roughly July 2027.

Where the Bill Stands Now

Versions of the New York Privacy Act have been introduced since 2019, and none have reached the governor’s desk. S3044 was referred to the Senate Internet and Technology Committee in January 2025, advanced to the Finance Committee in May 2025, and was then referred back to Internet and Technology in January 2026.¹ An earlier version, S365B, passed the full Senate in June 2024 but died when the Assembly never voted on it.²

For S3044 to become law, it still needs to clear its Senate committee, pass a full Senate vote, move through the corresponding Assembly committee and floor, and then be signed. That could take months or stretch past the session, and nothing guarantees it will happen at all.

How the One-Year Delay Works

The bill’s text draws a line between administrative setup and the parts businesses actually have to comply with. Definitions and administrative provisions would take effect on the day of signing. Everything that imposes real obligations, the applicability thresholds, consumer rights, controller and processor duties, data broker registration, and the Attorney General’s enforcement authority, carries a one-year delay.¹

In practical terms, the signing date is the clock-start. From that day, covered businesses have 12 months to build out their consent systems, consumer request workflows, data inventories, vendor agreements, and documented assessments before the law can be enforced against them.

Who Would Have to Comply

The act would apply to any legal entity that does business in New York or targets products and services at New York residents, if it meets at least one of these thresholds:

Annual gross revenue of $25 million or more
Controls or processes the personal data of 100,000 or more New York consumers
Processes data on 500,000 or more people nationwide and at least 10,000 New York consumers
Derives more than half of gross revenue from selling personal data and processes data on at least 25,000 New York consumers

A company that sells no data at all can still be covered if its revenue is high enough or if it touches enough consumer records.²

Certain data types are carved out rather than whole industries. Financial data under Gramm-Leach-Bliley, HIPAA-governed health information handled by a covered entity, FERPA education records and records under New York Education Law Section 2-d, employment records (unless sold), government data not sold, and data covered by the federal Driver’s Privacy Protection Act all sit outside the act. General nonprofits are not exempt; only a narrow category assisting insurance fraud investigations or first responders during catastrophic events is.¹

What Covered Businesses Would Have to Do

The most consequential feature of the bill is its consent model. Businesses would need opt-in consent before processing personal data beyond certain limited purposes. Most other state privacy laws only give consumers a right to opt out after collection. The NYPA flips the default: collect nothing beyond the basics unless the consumer affirmatively agrees.

Consumers would also gain the familiar set of individual rights: to know what categories of data a business holds and who it was shared with, to access a copy of their specific data, to correct errors, to request deletion subject to legal retention obligations, and to receive their data in a portable format. These rights apply to all personal data on file, not just data collected after enactment.

Businesses would have 45 days to respond to a consumer request, extendable once by another 45 days for unusually complex requests, with notice to the consumer inside the initial window.¹ Before producing data, the business must verify the requester’s identity. Denied requests require a written explanation and appeal instructions.

Controllers would also have to run documented data protection assessments for any processing that creates heightened consumer risk. Four activities trigger the requirement: targeted advertising, selling personal data, profiling that could cause unfair treatment or financial, reputational, or privacy harm, and processing sensitive data. The bill requires that these be done “regularly,” meaning they are revisited as practices change.¹ A separate data minimization requirement forces controllers to review retention annually and securely dispose of data no longer needed.

Enforcement and Penalties

Only the New York Attorney General would be able to enforce the NYPA. The bill does not include a private right of action, so individual consumers could not sue businesses directly.¹

Civil penalties run up to $20,000 per violation, with injunctions, restitution, and disgorgement of profits also on the table. Violations stack: each instance of unlawful processing counts separately, and processing data on multiple consumers creates a separate violation for each person affected. A single practice applied to 10,000 consumers could theoretically produce $200 million in liability.¹ The court weighs the seriousness of the misconduct, the number of violations, duration, willfulness, and the company’s financial condition when setting the actual amount.

Data brokers would carry extra exposure: a $1,000-per-day penalty for failing to register annually with the Attorney General or filing false registration information, plus fees owed and investigation costs, on top of the general per-violation framework.¹

What Already Applies to New York Businesses

While the NYPA waits, New York businesses are not unregulated. The Stop Hacks and Improve Electronic Data Security Act, signed in 2019, already requires any person or business that maintains private information of New York residents to implement reasonable administrative, technical, and physical safeguards, and to notify consumers after a breach. Penalties for failing to maintain safeguards run up to $5,000 per violation; failing to notify costs $20 per instance, capped at $250,000.³

The SHIELD Act handles security and breach notification. It does not give consumers rights to access, correct, or delete their data, and it does not require opt-in consent or data protection assessments. Those are the gaps the NYPA is written to fill.

What to Do Before the Clock Starts

If your business would clear one of the applicability thresholds, the one-year compliance window after any signing is shorter than it sounds. A few steps are worth starting now.

Build a data inventory. Map every category of personal data you collect, where it comes from, who receives it, and how long you keep it. Flag sensitive data, since it triggers both heightened consent and mandatory assessments. This work takes months at any sizable company and is useful regardless of which privacy law ultimately applies.

Review vendor and processor contracts. The bill assigns distinct obligations to controllers and processors, and existing agreements will likely need amendments covering data handling, security, and deletion.

Design your consumer request workflow. You will need verified intake, response tracking inside the 45-day window, an appeal path, and the ability to deliver data in a portable format. Companies that waited until the deadline to build these systems under California’s privacy law found rushed implementation expensive.

1
New York State Senate. NY State Senate Bill 2025-S3044
2
New York State Senate. NY State Senate Bill S365B
3
New York State Attorney General. Stop Hacks and Improve Electronic Data Security Act