Requires a business to delete a consumer's financial information after cancellation of an automatic renewal or continuous service, unless such consumer has affirmatively consented to retention of such financial information; requires such business to notify such consumer of such deletion.
Summary
This bill amends New York’s General Business Law to require businesses to delete a consumer’s financial information when the consumer cancels an automatic renewal or continuous service, unless the consumer gives affirmative consent for the business to keep that information for future purchases. The bill defines financial information to include information related to a consumer’s credit card, debit card, or third-party account held by a business for charging purposes.
If a consumer cancels, the business must delete all records of that financial information within 14 days unless retention is otherwise authorized by the consumer. The business must also notify the consumer by mail or email within seven days after deletion, identifying the date of deletion and which cards or accounts were deleted. The bill does not apply where another state or federal law requires the business to retain the information.
Impact
The bill would add a new consumer-protection requirement to the General Business Law governing automatic renewals and continuous services, creating a mandatory data-deletion obligation tied to cancellation requests. It would affect businesses that store payment credentials for subscription, membership, or recurring-service billing, and would require them to change record-retention and customer-notification practices. The bill preserves existing legal retention duties by exempting information that must be kept under other state or federal laws, rules, or regulations.
Sentiment
The available legislative history suggests generally favorable treatment, as the bill was reported favorably from committee and advanced through the Senate process with amendments. No recorded votes or committee transcript excerpts are provided, so there is no evidence of formal opposition in the supplied materials. Overall, the bill appears to have been viewed as a consumer privacy and billing transparency measure rather than a controversial policy change.
Contention
The main policy issue is the balance between consumer privacy and business recordkeeping. Supporters would likely favor the bill’s requirement that businesses delete stored payment information after cancellation to reduce unwanted charges and limit retention of sensitive financial data. Potential concerns for businesses include compliance costs, the operational burden of deleting records within a short timeframe, and the need to maintain records where other laws require retention. The affirmative-consent exception and the carveout for legally required retention are the bill’s principal compromise points.
Requires a business to delete a consumer's financial information after cancellation of an automatic renewal or continuous service, unless such consumer has affirmatively consented to retention of such financial information; requires such business to notify such consumer of such deletion.
Requires businesses to notify consumers of an upcoming automatic renewal or continuous service charge to the consumer's account forty-five days prior to such charge; requires businesses to include instructions on how to cancel such renewal or charge in the notice to the consumer.
Requires entities that access a consumer's consumer credit report to notify such consumer of their right to obtain a security freeze, in addition to other information necessary to place, temporarily lift or permanently lift such security freeze; prohibits notices to consumers of their right to obtain a security freeze from containing advertising for paid services.
Requires businesses that make an automatic renewal offer or continuous service offer to provide a link on any public website it maintains for cancellation of such service.
Requires that businesses that provide consumers with online accounts to access services accounts for mobile telephones using proper identification if the business has a physical presence in this state.