This bill creates a new article in the General Business Law to regulate the collection, processing, disclosure, and monetization of location information for people located in New York. It generally prohibits covered entities from collecting or processing location data unless they have a permissible purpose, provide a location privacy policy, and obtain the individual’s opt-in consent. The bill defines location information broadly to include GPS coordinates, cell-site location information, and IP addresses capable of revealing physical location, while excluding certain information derived solely from legally obtained images or publicly posted words.
The bill also limits how location data may be used after it is collected. It bars selling, renting, trading, or leasing location information to third parties, restricts disclosure to government agencies unless there is a warrant, exigent circumstances, a legal mandate, or the individual’s request, and requires consent to expire after one year, when the purpose is complete, or upon revocation. It further requires deletion of location data when consent expires, mandates notice before privacy policy changes, and prohibits government entities from monetizing location information. The bill includes special rules for targeted advertising, requiring a clear opt-out mechanism when location data is used for ad delivery.
The bill’s impact on state law would be significant for businesses, apps, data brokers, advertisers, and service providers that handle geolocation data in New York. It creates a new statutory privacy framework, imposes disclosure and retention limits, and authorizes the Attorney General to promulgate rules. It also gives individuals a private right of action in court, treats violations as unfair or deceptive acts or practices, and allows damages, punitive damages, injunctive relief, and attorney’s fees. Contract terms that waive these rights would be void and unenforceable.
The overall sentiment reflected by the bill text is strongly privacy-protective and consumer-focused, with an emphasis on informed consent, data minimization, and limits on commercial exploitation of sensitive location data. Because there are no committee transcripts or recorded votes provided, there is no direct evidence of legislative support or opposition in the available context. The bill’s structure suggests a policy goal of preventing surveillance-style data practices while preserving narrow exceptions for emergencies, legal compliance, and services requested by the user.
The main points of contention likely concern the breadth of the restrictions and the compliance burden on technology companies, advertisers, and data intermediaries. Potentially disputed issues include the scope of “location information,” the requirement for discrete consent for multiple purposes, the ban on sale or trade of location data, and the private right of action with statutory damages. Another likely area of debate is the exception structure, especially how much location data can be used for service features, targeted advertising, and government requests without a warrant.
The bill would amend the New York General Business Law by adding a new article governing location data privacy. It would impose new duties on covered entities and service providers that collect or process location information, including consent, notice, retention, deletion, and disclosure restrictions, while creating enforcement mechanisms through private lawsuits and Attorney General actions. It would also make violations an unfair or deceptive act or practice and invalidate contractual waivers of rights under the article.
The bill appears to be driven by a strong pro-privacy, anti-surveillance sentiment, aiming to give individuals meaningful control over sensitive location data and to curb commercial sale and government access absent legal safeguards. No committee debate or vote history is available, so there is no recorded split in the provided materials. Based on the text alone, the measure is framed as consumer protection legislation with a clear emphasis on consent, transparency, and enforcement.
Likely areas of contention include whether the bill is too restrictive for app developers, advertisers, and data brokers that rely on location data for core services or targeted advertising, and whether the consent and privacy-policy requirements are operationally burdensome. The private right of action, statutory damages, attorney’s fees, and voiding of waiver clauses may also draw opposition from industry groups concerned about litigation exposure. On the other side, privacy advocates would likely support the bill’s warrant requirement for government disclosure, its ban on monetizing location data by government entities, and its limits on sale or sharing of location data.