NY S05156

Expands New York's right of privacy law to cover collection, storage, and use of personal data, biometric data, location data, and video for advertising, trade, data-mining, or commercial purposes, requiring written consent and imposing a misdemeanor penalty for violations

Requires businesses meeting certain thresholds (over $50 million in annual revenue, handling data of 50,000+ consumers, or deriving 50%+ of revenue from selling personal data) to disclose their data collection practices, sources, purposes, retention periods, and third-party sharing in privacy policies updated annually

Grants consumers rights to request deletion of their personal information, access the specific data businesses hold about them, receive disclosure of third parties their data was shared with, and opt out of data sales without facing discrimination in pricing or service quality

Establishes an opt-in consent requirement for data collection and sharing beyond what is necessary to provide requested services, treating collected personal information as consumer property with businesses acting as bailees with a duty of reasonable care

Creates a private right of action allowing consumers to sue for up to $750 per violation or actual damages, plus attorney fees, while authorizing civil penalties of $7,500 for intentional violations and $2,500 for unintentional violations enforced by the Attorney General