Law / United States / 
New York
New York Child Data Protection Act
N.Y. Gen. Bus. Law art. 39-FF, §§ 899-ee to 899-mm (2024 N.Y. Laws ch. 121)
In force since .
A sensitive categories rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- User location
- Obligation class
- Consent, Disclosure, Prohibition, Retention
- Audit expectation
- none
As of .
What it requires
- If you operate a website, online service, application or connected device that you actually know is used by a minor under 18, or that is primarily directed to minors, do not process that user's personal data, or let a processor or third-party operator process or collect it, unless the user is 12 or younger and the processing is permitted under 15 U.S.C. § 6502, or the user is 13 or older and the processing is strictly necessary for a purpose the article lists or you have the user's informed consent (Section 899-ff(1) and (2)).
- Ask for informed consent separately from any other transaction, with no design that obscures or impairs the user's decision, state that the processing is not strictly necessary and that the user may decline without losing use of the service, and make the option to refuse the most prominent option (Section 899-ff(3)(a)).
- Let a user revoke consent at any time as easily as it was given, and after a refusal or revocation do not ask again for the same processing for the following calendar year (Section 899-ff(3)(b) and (c)).
- Do not withhold, degrade, lower the quality of or raise the price of a product, service or feature because you did not obtain parental consent or informed consent, unless the processing is strictly necessary to provide it (Section 899-ff(4)).
- Do not purchase or sell a covered user's personal data, or allow a processor or third-party operator to do so (Section 899-ff(5)).
- Within thirty days of determining or being told that a user is a covered user, delete the user's personal data that you may not keep, direct your processors to delete it, and notify any third-party operator you know received it (Section 899-ff(6)).
- Before you disclose personal data to a third-party operator, or let one collect it, tell it when your service is primarily directed to minors or when the data concerns a covered user (Section 899-ff(7)).
- Do not disclose a covered user's personal data to a third party, or let one process it, without a written, binding agreement that sets out the nature and purpose of the processing, the instructions for using or further disclosing the data, and each party's rights and obligations (Section 899-gg(1)).
- Treat a user as a covered user where the user's device signals that the user is or shall be treated as a minor, and follow a device's clear and unambiguous signal about consent (Section 899-ii).
- When you learn that a user is no longer a covered user, stop processing the user's personal data that the article would otherwise restrict until you obtain informed consent, and notify the user that the article's protections no longer apply (Section 899-hh).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
The Attorney General may obtain civil penalties of up to five thousand dollars per violation; the amount is a ceiling for each violation and the article states no aggregate cap.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
New York Attorney General, the only official the article empowers to bring an action, who may also make rules to enforce it.
What it makes you log
Who may demand the log
Counterparty
Logging duty
The article asks an operator for no log. It does require a processor to give the operator evidence of a deletion within thirty days of the deletion request, and on the operator's reasonable request to make available the information needed to show the processor's compliance with the article. Section 899-mm gives the Attorney General no power to demand a record, and no period for keeping one is stated.
- Kind
- Implicit
- As of
- Provision
- N.Y. Gen. Bus. Law § 899-gg(3), (4) and (5)(c) (a processor provides evidence of deletion to the operator and makes available the information needed to demonstrate its compliance)
- Trigger
- personal_data_processing
What this law does
Article 39-FF of the General Business Law, added by chapter 121 of the Laws of 2024 and effective , binds an operator of a website, online service, application or connected device that actually knows a user is under 18, or that is primarily directed to minors.
For such a covered user, the operator may not process the user's personal data, or allow a processor or third-party operator to process or collect it, unless the user is 12 or younger and the processing is permitted under 15 U.S.C. § 6502 and its implementing regulations, or the user is 13 or older and the processing is strictly necessary for a purpose the article lists or informed consent was obtained.
Consent must be requested separately, with the option to refuse as the most prominent option, and after a refusal the operator may not ask again for the following calendar year. The operator may not purchase or sell a covered user's personal data, and within thirty days of learning that a user is covered must delete the data it may not keep.
The article empowers only the Attorney General to sue, for an injunction, restitution, disgorgement, damages and civil penalties of up to five thousand dollars per violation, and it states no private right of action.
When LexLint raises it
When your app profile says your app serves under-18s or processes personal data.