Senate Bill 3281 An act to amend the general business law, in relation to enacting the New York child data privacy and protection act was introduced, on 30 January 2023, to the New York State Senate, and thereafter referred, on the same date, to the State Senate Internet and Technology Committee. In particular, the bill highlights that each entity offering an online product that is targeted towards child users in New York must complete a Data Protection Impact Assessment ('DPIA'), which shall assess factors including:

• the ways in which child users primarily interact with or consume the online product;
• the amount of time, on average, child users spend using the online product, including features designed to extend the amount of time;
• the amount and type of data on child users collected, retained, processed, or sold;
• the purpose of collection, retention, processing, or sale of such data;
• if the entity is a data controller, the sharing relationship with data processors, and third parties with whom children's personal data is shared;
• any privacy policies, terms of service, or other legal policies, and whether these require approval of the parent or legal guardian;
• opportunities for individuals developing an online product targeted towards child users to voice concerns about a product before, during, and after development without fear of retaliation; and
• whether and how child users can limit exposure to certain types of content.

Notably, the bill provides that the DPIA must be submitted to the Bureau of Internet and Technology within five days of completion.

In addition, the bill outlines a prohibition on data collection and digital advertising, providing no entity offering an online product targeted towards child users can collect, retain, process, or sell personal data unless it is necessary to provide such a service to users. Likewise, the bill notes that no product may use targeted advertising unless consent for such advertising is obtained from the child's parent or legal guardian. Further, the bill details that no entity offering an online product intended for educational purposes shall collect, retain, process, or sell the personal data of child users.

You can read the bill and track its progress here.

UPDATE (27 February 2023)

Companion bill introduced to State Assembly

Assembly Bill A04967 was introduced, on 27 February 2023, to the New York State Assembly, and thereafter referred, on the same date, to the State Assembly Science and Technology Committee. 

You can read the bill here and track its progress here.