Crawls the web, in New York

N.Y. Gen. Bus. Law section 899-bb (Article 39-F, added by L. 2019, ch. 117 (S5575-B/A5635-B), section 4) · Read the law's page

• This binds any person or business that owns, licenses, or maintains computerized data including the private information of a New York resident; a business already a compliant regulated entity under Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or 23 NYCRR Part 500 (the New York Department of Financial Services cybersecurity regulation for a financial-services licensee) is deemed to comply.
• Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).
• A small business, fewer than 50 employees, under $3,000,000 in gross annual revenue in each of the last three fiscal years, or under $5,000,000 in year-end total assets, may scale its program's administrative, technical, and physical safeguards to its own size, complexity, and the sensitivity of the personal information it collects.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of General Business Law 349, seeking injunctive relief and a civil penalty of up to $5,000 per violation under General Business Law 350-d.

N.Y.C. Admin. Code §§ 22-1201 to 22-1205 (Local Law 2021/003) · Read the law's page

• If you are a commercial establishment in New York City collecting, retaining, converting, storing, or sharing biometric identifier information, including from scraped or captured photos processed into a face-geometry scan, post clear and conspicuous signage disclosing that practice.
• Never sell, lease, trade, or otherwise profit from biometric identifier information collected from a New York City commercial establishment's customers; this ban carries no notice-and-cure period before a lawsuit.
• An aggrieved person can sue you directly under this ordinance's private right of action; a signage violation gives you 30 days to cure before suit, but a sale or profit violation does not.

N.Y. Penal Law §§ 156.00, 156.05, 156.10 · Read the law's page

• Do not continue accessing a New York-connected system, or circumvent a technical security measure, after the operator has given you actual notice, including a cease-and-desist letter, that your access is unwanted; this statute treats notice alone as sufficient to convert continued access into unauthorized access, without needing a technical block.
• Repeated exposure to terms of use posted on every response to your automated queries can support a trespass-to-chattels claim even without a signed agreement, under Register.com v. Verio (2d Cir. 2004).
• Independently gathering the same time-sensitive facts a competitor also gathers is not hot-news misappropriation under New York law; copying a competitor's own compiled output, rather than gathering the underlying facts yourself, is the fact pattern the surviving tort still reaches.

N.Y. S. 9934-A (2025-2026), adding N.Y. Gen. Bus. Law art. 48 · Read the law's page

• This bill has not been enacted; what follows is what it would require if signed in this form.
• If you operate a crawler that accesses a covered news source, identify it with a valid and accurate user-agent string that states the software product, its version, and the company behind it.
• Disclose the specific nature and purpose of the crawler, including every use the news source's content could be put to, at or before the time you request access and in a format the journalism provider can access.
• Do not deploy a crawler that omits these disclosures in a manner that would damage, impair, or burden the operation of a covered news source or otherwise cause it economic harm.