NY S09073

Establishes comprehensive data privacy protections for New York residents, including rights to access, delete, and obtain disclosure of personal information collected by businesses.

Requires businesses meeting specified thresholds (annual revenues over $50 million, buying/selling personal information of 50,000+ consumers, or deriving 50%+ of revenue from selling personal data) to provide transparency through privacy policies disclosing collection methods, purposes, retention periods, and third-party sharing.

Grants consumers rights to request deletion of personal information, access retained data in portable formats, learn who their information was disclosed to, and opt-in to additional data collection or sharing with 12-month waiting periods before re-requesting consent.

Prohibits businesses from discriminating against consumers who exercise privacy rights by denying services, charging different prices, or providing lower quality service based on data requests or refusal to consent to additional data collection.

Creates private right of action allowing consumers to sue for violations with statutory damages up to $750 per violation or actual damages (whichever is greater), plus attorney fees; establishes civil penalties of up to $7,500 per intentional violation enforced by the Attorney General.