NY A08149

Establishes the New York Child Data Protection Act regulating how operators of websites, online services, applications, and connected devices handle personal data of minors under 18 years old.

Prohibits operators from processing personal data of minors unless processing is permitted under federal COPPA rules (for users 12 and under) or is strictly necessary for specific business operations like providing requested services, fixing technical errors, or preventing fraud.

Requires operators to obtain informed consent from users 13 and older for non-essential data processing, with consent requests kept separate from other transactions and refusal presented as the most prominent option; consent must be freely revocable at any time.

Prohibits the purchase or sale of minors' personal data and requires written agreements with data processors; operators must delete personal data within 30 days of learning a user is a minor unless processing is permitted.

Authorizes the attorney general to enforce the act through civil actions seeking injunctions, restitution, disgorgement of profits, damages, and civil penalties up to $5,000 per violation; act takes effect one year after becoming law.