NY S09563

Establishes the New York Child Data Privacy and Protection Act regulating online products targeted at users under 18 years old, with enforcement by the Bureau of Internet and Technology in the Attorney General's office.

Requires entities to complete data protection impact assessments before launching products targeting children, analyzing data collection practices, engagement features, security measures, content standards, and potential harms to child users.

Prohibits collection, retention, processing, or sale of personal data from child users unless necessary to provide the product or demonstrating a compelling reason that furthers the child's interest.

Bans targeted digital advertising to child users unless parental or legal guardian consent is obtained and a compelling reason is demonstrated; completely prohibits data collection by educational products.

Mandates privacy-by-default settings, proactive alerts when personal data is collected, parental consent for terms of service, accessible reporting methods for problems, and biennial reports to the legislature; establishes civil penalties up to $20,000 per violation (capped at $250 million) and private right of action for affected children with damages and attorney fees.