N.Y. General Business Law § 899-ff: Privacy protection by default

§ 899-ff. Privacy protection by default. 1. Except as provided for in

subdivision six of this section and section eight hundred ninety-nine-jj

of this article, an operator shall not process, or allow a processor to

process, the personal data of a covered user collected through the use

of a website, online service, online application, mobile application, or

connected device, or allow a third-party operator to collect the

personal data of a covered user collected through the operator's

website, online service, online application, mobile application, or

connected device unless and to the extent:

(a) the covered user is twelve years of age or younger and processing

is permitted under 15 U.S.C. § 6502 and its implementing regulations; or

(b) the covered user is thirteen years of age or older and processing

is strictly necessary for an activity set forth in subdivision two of

this section, or informed consent has been obtained as set forth in

subdivision three of this section.

2. For the purposes of paragraph (b) of subdivision one of this

section, the processing of personal data of a covered user is

permissible where it is strictly necessary for the following permissible

purposes:

(a) providing or maintaining a specific product or service requested

by the covered user;

(b) conducting the operator's internal business operations. For

purposes of this paragraph, such internal business operations shall not

include any activities related to marketing, advertising, research and

development, providing products or services to third parties, or

prompting covered users to use the website, online service, online

application, mobile application, or connected device when it is not in

use;

(c) identifying and repairing technical errors that impair existing or

intended functionality;

(d) protecting against malicious, fraudulent, or illegal activity;

(e) investigating, establishing, exercising, preparing for, or

defending legal claims;

(f) complying with federal, state, or local laws, rules, or

regulations;

(g) complying with a civil, criminal, or regulatory inquiry,

investigation, subpoena, or summons by federal, state, local, or other

governmental authorities;

(h) detecting, responding to, or preventing security incidents or

threats; or

(i) protecting the vital interests of a natural person.

3. (a) For the purposes of paragraph (b) of subdivision one of this

section, to process personal data of a covered user where such

processing is not strictly necessary under subdivision two of this

section, informed consent must be obtained from the covered user either

through a device communication or signal pursuant to the provisions of

subdivision two of section eight hundred ninety-nine-ii of this article

or through a request. Requests for such informed consent shall:

(i) be made separately from any other transaction or part of a

transaction;

(ii) be made in the absence of any mechanism that has the purpose or

substantial effect of obscuring, subverting, or impairing a covered

user's decision-making regarding authorization for the processing;

(iii) clearly and conspicuously state that the processing for which

the consent is requested is not strictly necessary, and that the covered

user may decline without preventing continued use of the website, online

service, online application, mobile application, or connected device;

and

(iv) clearly present an option to refuse to provide consent as the

most prominent option.

(b) Such informed consent, once given, shall be freely revocable at

any time, and shall be at least as easy to revoke as it was to provide.

(c) If a covered user declines to provide or revokes informed consent

for processing, another request may not be made for such processing for

the following calendar year, however an operator may make available a

mechanism that a covered user can use unprompted and at the user's

discretion to provide informed consent.

(d) If a covered user's device communicates or signals that the

covered user declines to provide informed consent for processing

pursuant to the provisions of subdivision two of section eight hundred

ninety-nine-ii of this article, an operator shall not request informed

consent for such processing, however an operator may make available a

mechanism that a covered user can use unprompted and at the user's

discretion to provide informed consent.

4. Except where processing is strictly necessary to provide a product,

service, or feature, an operator may not withhold, degrade, lower the

quality, or increase the price of any product, service, or feature to a

covered user due to the operator not obtaining verifiable parental

consent under 15 U.S.C. § 6502 and its implementing regulations or

informed consent under subdivision three of this section.

5. Except as provided for in section eight hundred ninety-nine-jj of

this article, an operator shall not purchase or sell, or allow a

processor or third-party operator to purchase or sell, the personal data

of a covered user.

6. Within thirty days of determining or being informed that a user is

a covered user, an operator shall:

(a) dispose of, destroy, or delete and direct all of its processors to

dispose of, destroy, or delete all personal data of such covered user

that it maintains, unless processing such personal data is permitted

under 15 U.S.C. § 6502 and its implementing regulations, is strictly

necessary for an activity listed in subdivision two of this section, or

informed consent is obtained as set forth in subdivision three of this

section; and

(b) notify any third-party operators to whom it knows it disclosed

personal data of that covered user, and any third-party operators it

knows it allowed to process the personal data that may include the

personal data of that user, that the user is a covered user.

7. Except as provided for in section eight hundred ninety-nine-jj of

this article, prior to disclosing personal data to a third-party

operator, or permitting a third-party operator to collect personal data

from the operator's website, online service, online application, mobile

application, connected device, or portion thereof, the operator shall

disclose to the third-party operator:

(a) when their website, online service, online application, mobile

application, connected device, or portion thereof, is primarily directed

to minors; or

(b) when the personal data concerns a covered user.