Prohibits data brokers from selling the personal information of current and former military service members
This bill would add a new section to New York’s General Business Law prohibiting data brokers from selling or advertising personal information about current or former military servicemembers, or lists compiled about servicemembers and their family members, unless the servicemember has given consent. The bill defines key terms such as “data broker,” “sale,” “targeted advertising,” “personal data,” and “military servicemember,” and it sets a broad framework for when consent is valid and how it may be withdrawn.
The prohibition applies to businesses operating in New York or targeting New York residents, but it includes numerous exclusions for data practices already governed by other laws or contexts, such as consumer reporting, financial institutions under federal law, health information, education records, employment records, and certain public health or research activities. Enforcement would be through the Attorney General, who could seek injunctions, restitution, and civil penalties of up to $10,000 per violation. The bill would take effect 90 days after becoming law.
The bill would amend the General Business Law by creating a new consumer privacy restriction specifically protecting servicemembers and their families from data brokerage and targeted advertising practices. It would not broadly ban all data sharing, but it would make it unlawful for covered data brokers to sell or advertise servicemember-related personal data without consent, while preserving existing federal and state privacy regimes for credit, banking, health, education, and other regulated data categories. The Attorney General would gain express enforcement authority, including subpoena power, injunctive relief, restitution, and civil penalties.
The available context suggests generally favorable treatment of the bill, as reflected by its protective purpose and the absence of recorded opposition, votes, or committee debate in the provided materials. The measure appears framed as a privacy and consumer-protection bill aimed at shielding military families from commercial exploitation of sensitive personal information. Because there are no transcripts or vote tallies, there is no documented public split in the supplied record.
The main potential points of contention are likely to be the scope of the ban and the breadth of the definitions, especially what counts as a “sale,” “targeted advertising,” and a “data broker,” since those terms can capture a wide range of modern data practices. Another possible issue is the consent standard, which places the burden on the controller and requires clear, affirmative permission, potentially raising compliance concerns for businesses. The bill’s many exemptions may also be debated by privacy advocates who may view them as too broad, or by industry stakeholders who may argue they are necessary to avoid conflict with federal law and existing regulated data uses.