New York Privacy Act: What marketers need to know before it passes

Every few years, a piece of legislation moves through a state capitol quietly, and then suddenly it's everywhere. California's CCPA was like that, and so was GDPR before it. The New York Privacy Act (NYPA) has been circling for years, getting reintroduced, refined, and referred back to committee. But in 2025, it passed a key senate committee vote and picked up real legislative momentum. It still isn't law, but if you're a marketer whose brand does business in New York, the direction is unmistakable, and waiting until it passes to understand it is a real business risk.

For marketers specifically, the NY Privacy Act isn't just a compliance issue to hand off to legal. It directly affects how brands go about processing personal data, how targeting works, and how well your attribution tools will function. Getting ahead of it is a business decision, not just a legal one.

Key takeaways

• The New York Privacy Act (NYPA) is a proposed state law that would require companies to obtain consent from New York consumers before collecting, processing, or selling their personal data.
• Unlike California's CCPA, which uses an opt-out model, the NYPA would require opt-in consent, a stricter standard that would significantly affect how brands run targeted advertising.
• The bill covers sensitive data categories including health information, ethnic origin, and financial account data with additional protections beyond standard personal data.
• Even without a comprehensive consumer privacy law in place, New York's Attorney General has already investigated and penalized companies for cookie tracking violations; enforcement is happening now.
• Data brokers would face specific obligations under the NYPA, including registration and stricter data sharing rules.
• Marketing measurement tools that rely on user-level tracking, like multi-touch attribution (MTA), become less reliable as privacy laws tighten. Marketing mix modeling (MMM) offers a measurement approach that doesn't depend on tracking individuals at all.
• Brands selling to New York consumers should be auditing their consent management and data practices today, not after the bill passes.

What is the New York Privacy Act?

The New York Privacy Act is a proposed consumer data protection law that has been reintroduced in the 2025–2026 legislative session as companion bills A4947 (Assembly) and S3044 (Senate). If passed, the law would amend New York's general business law to give New York consumers meaningful control over how their personal data is collected, processed, and shared.

At its core, the NYPA would require companies to disclose their methods of de-identifying personal information, place special safeguards around data sharing with third parties, and allow consumers to obtain the names of all entities their personal data has been shared with. The New York State Attorney General would be empowered to investigate violations and pursue penalties, and New York consumers who are harmed would have a private right of action, including the right to recover attorney's fees.

The NY Privacy Act has been introduced and stalled multiple times over the years, but 2025 marks the furthest it has progressed. It passed a key senate committee vote in May 2025—clearing that senate committee hurdle is the furthest the NYPA has gotten—and has two active companion bills moving through both chambers, though it hasn't cleared both chambers or reached the governor's desk yet.

What rights would the NYPA give consumers?

Here's a snapshot of the consumer rights the New York Privacy Act would establish if it passes:\

The sensitive data categories that would require opt-in consent include health and medical information, ethnic origin, sexual orientation, financial account data, biometric data, and information about children. These categories would carry stricter obligations than standard personal data under the bill.

How the NYPA compares to other privacy laws

It helps to see the NYPA alongside the other consumer data protection laws that currently exist. The most relevant comparison for US brands is California's CCPA and its successor, the CPRA, two laws with different data protection philosophies that reflect just how varied the state privacy landscape already is.\

The NYPA's opt-in requirement is the single most important differentiator for marketers. Worth noting: the bill's thresholds for who must comply are tied to the gross revenue a company earns from New York consumers and the volume of personal data processed, not just company size. California's data protection model defaults to allowing data collection unless a consumer actively opts out. The NY Privacy Act would flip that: data processing doesn't happen until a New York consumer says yes.

What this means for marketing and advertising

The NY Privacy Act would affect day-to-day marketing operations in several specific ways:

Targeted advertising gets harder. The bill would require companies to obtain consent before processing personal data for targeted advertising purposes. Behavioral targeting—serving ads based on browsing history, purchase behavior, or inferred interests—depends on collecting that personal data first. Under the NYPA, brands would need explicit opt-in before any of that data collection happens for New York consumers.

Third-party data sharing faces new scrutiny. Any request to share or sell personal data to a third party would need to clearly state who that third party is and what they plan to do with the data. Vague disclosures buried in a privacy policy won't hold up. This affects everything from ad tech partnerships to data broker relationships.

Data brokers face specific rules. The NY Privacy Act includes dedicated provisions for data brokers, companies that collect and sell data about individuals they don't have a direct relationship with. These entities would face registration requirements and stricter data sharing obligations than other companies, including rules around how personal data is shared downstream to third parties.

Enforcement is already happening. This is the part many brands miss. New York doesn't currently have a comprehensive consumer privacy law, but the Attorney General's office has already been actively investigating cookie tracking practices under existing general business law and consumer protection statutes. In 2024, the AG's office analyzed cookie activity across a variety of websites—relying on existing consumer protection authority—and notified 13 companies of violations. All of them resolved the issues, but the message was clear: the AG is already watching.

How to prepare now

You don't need to wait for the NY Privacy Act to pass to start getting your house in order. Here are the most important areas to address:

• Audit your consent management setup. The AG's 2024 investigation found that many companies had misconfigured consent tools: cookies weren't being disabled when users opted out, or marketing cookies were miscategorized so they weren't subject to consumer controls at all. Even if you have a consent banner, it may not be functioning correctly.
• Map your data sharing. Make a list of every third party that receives data from your website or ad stack. The NYPA would require companies to be able to disclose all of these relationships, and regulators are already asking under current law.
• Stress-test your measurement approach. If your attribution strategy relies heavily on user-level tracking, it's worth understanding what happens to your reporting when processing personal data at the individual level becomes harder to do legally. The erosion has been happening for years as iOS updates, browser restrictions, and ad blockers have steadily reduced data availability; privacy laws like the NYPA accelerate it.
• Understand your jurisdictional scope. The NY Privacy Act's requirements would apply to companies based on the volume of personal data they process and the gross revenue—specifically annual gross revenue tied to New York consumers—that they generate. If your brand does meaningful business in New York, you're very likely in scope.

Where Prescient comes in

As privacy laws tighten—and the NY Privacy Act is one of several moving through state legislatures right now—the measurement tools most affected are the ones built on user-level tracking. Multi-touch attribution models work by following individual consumers across touchpoints, and that capability shrinks every time a new consent requirement or browser change reduces data availability. The problem isn't that those tools are poorly built; it's that the personal data they depend on is under pressure, and legislation like the NYPA accelerates that pressure significantly for any brand doing business with New York consumers.

Prescient uses marketing mix modeling, which works differently. Rather than tracking individuals, it uses aggregate data and statistical modeling to understand what's driving revenue across your channels: no cookies, no user identifiers, no consent dependencies. That means your measurement doesn't degrade as privacy laws evolve. Brands that make this shift now won't face a measurement crisis when the NY Privacy Act or the next state privacy law passes. See the future-proof Prescient dashboard and all the insights it can reveal for your brand when you book a demo.

FAQs

Has the New York Privacy Act been passed into law?

Not yet. As of 2025, the NY Privacy Act exists as two companion bills—A4947 in the Assembly and S3044 in the Senate—both currently in committee. The bill cleared a key senate committee vote in May 2025—the furthest it has progressed in its legislative history—but it has not cleared both chambers or been signed by the governor. New York does not currently have a comprehensive consumer privacy law, though the Attorney General is actively enforcing cookie and tracking compliance under existing consumer protection statutes.

How is the NYPA different from California's CCPA?

The most important difference is the consent model. California's CCPA uses an opt-out approach: companies can collect and process personal data by default, and consumers must take action to stop it. The NY Privacy Act would require opt-in consent: companies could not collect or process personal data until a New York consumer actively agrees. The NYPA also includes a broader private right of action, giving individual consumers the ability to sue for violations, whereas California's CCPA limits that right primarily to data breach situations.

Does the NYPA affect how businesses use cookies and tracking pixels?

Yes, in meaningful ways. The NYPA's opt-in consent requirement would apply to personal data collected through cookies and tracking technologies when that data is used for targeted advertising or shared with third parties. The New York Attorney General's office has also published detailed guidance on website privacy controls and investigated companies for cookie-related violations under existing law, so even before the NYPA passes, New York is an active enforcement environment for tracking practices.

What should marketing teams do to prepare for the NYPA?

The most useful steps right now are operational: audit your consent management platform to confirm that opt-outs are actually being honored across all your tags and cookies, document your data sharing relationships with third parties, including which vendors receive portable data exports or enriched audience files, and evaluate whether your marketing measurement approach holds up in a lower-data environment. Teams that rely heavily on behavioral targeting and user-level attribution tools should be thinking about what their strategy looks like if opt-in rates are low because the broader trend toward consumer data rights and expanded consumer rights over personal data is only moving in one direction, regardless of when the NYPA itself passes.