This bill, titled the “right to know act,” would create new consumer privacy rights in New York by requiring businesses that retain a customer’s personal information to provide that customer free access to, or copies of, the information they hold. If a business discloses a customer’s personal information to third parties, it would also have to tell the customer what categories of information were shared and identify the third parties that received it, including contact information when available. The bill allows businesses to satisfy these obligations through a designated request process, prior or immediate notice of disclosures, or by providing a compliant disclosure under federal law if it also meets the bill’s requirements.
The bill defines personal information broadly to include identifiers such as names, addresses, phone numbers, account names, government IDs, birthdate or age, physical characteristics, sexual orientation and gender identity, race, religion, political affiliation, employment and education information, medical and financial information, commercial and purchasing history, location data, internet and mobile activity, user-generated content, and similar information about children. It also defines “business,” “customer,” “disclose,” “retains,” “third party,” and related terms, while carving out several exceptions for service providers, legal compliance, fraud/security protection, and publicly available information. Violations would be treated as an injury to the customer and could support civil enforcement by the customer, the attorney general, district attorneys, city attorneys, or city prosecutors.
The bill would amend the General Business Law, including the heading of Article 39-F, and add a new section 899-cc establishing these disclosure and access requirements. It would expand state privacy law beyond existing data security and breach notification concepts by focusing on transparency around routine sharing and sale of personal data, not just unauthorized acquisition. Businesses operating in New York would need to update privacy policies, customer request procedures, and internal compliance practices to respond to consumer requests and disclosure obligations.
Because there are no recorded votes or committee transcripts in the provided materials, there is no documented legislative debate or formal sentiment history to assess. Based on the bill text alone, the measure appears strongly consumer-protective and privacy-focused, emphasizing transparency, informed choice, and control over personal data. The overall tone is rights-expanding rather than regulatory-light, with the stated goal of helping consumers understand how businesses collect, share, and sell their information.
The main points of contention likely concern the breadth of the disclosure obligations, the wide definition of personal information, and the compliance burden on businesses, especially those with extensive data-sharing practices or multiple privacy policies. Another likely issue is the bill’s enforcement structure, which allows private and public civil actions for violations. Supporters would likely emphasize privacy, consumer safety, and financial security, while critics may argue that the bill is operationally burdensome or overlaps with existing federal and state privacy frameworks.
The bill would add a new consumer privacy disclosure regime to New York’s General Business Law, requiring businesses to provide customers with free access to retained personal information and detailed disclosures about third-party sharing. It would broaden state law’s treatment of data practices by regulating not only unauthorized acquisition and security protections, but also the lawful disclosure and sale of personal information. Businesses would need to maintain request channels, update privacy notices, and comply with customer access and disclosure timelines, while customers and public prosecutors would gain a new basis for civil enforcement.
No committee transcript or vote record is provided, so there is no direct evidence of legislative support or opposition in the available history. The bill’s text reflects a clear pro-privacy, consumer-rights orientation, suggesting the sponsor’s intent is to increase transparency and control over personal data. Overall, the measure reads as protective of consumers and skeptical of broad data-sharing practices by businesses.
The likely areas of contention are the scope of the information covered, the administrative burden on businesses, and the enforcement mechanism. Businesses may object to having to disclose categories of data and third-party recipients, maintain designated request addresses, and respond within set timeframes, especially where data is shared through complex vendor and advertising networks. Privacy advocates, by contrast, would likely support the bill’s broad definitions, customer access rights, and civil enforcement provisions as necessary to address modern data brokerage and online tracking practices.