What happened?

On June 20, 2024, Governor Kathy Hochul signed the New York Child Data Protection Act (S7695), a bill (now law) that the New York legislature passed a bill directed at kids’ use of online technologies:

What are the details?

General Bites:

• The act prohibits all online sites from collecting, using, sharing, or selling personal data of anyone under the age of 18 for advertising, unless they receive informed consent or unless doing so is strictly necessary for the website.
• The act is part of New York’s efforts to protect children and teens from addictive algorithms and exploitative data collection on social media.
• For minors aged 13 to 17, the act bars online operators from collecting, using, sharing, and selling their data without their informed consent unless strictly necessary. It requires parental consent to process the data of minors 12 years of age and younger.

Key Bites for Operators:

• The law applies to Operators as defined in the law.

• The law covers users as defined in the law, and is limited to New York State

• Requirements:
  • Restrictions
  • Purchase and sell of information
  • Data Deletion
  • Age Flagging or Alerts
  • Purpo ses for Collection

• The New York State Attorney General’s Office is empowered to enforce the Act.

• Posting and Notice Requirements:

• Covered entities are required to prominently display a privacy policy and terms of service that clearly and concisely communicate warnings about potential harms to child users, using language likely to be understood by an individual in the age range targeted by the product.

• Operators must provide notice to third-party operators that collect, or process covered user personal data on the operator’s website, online service, etc. if the website, online service, etc. is primarily directed to minors or the personal data concerns a covered user.

• Penalties for Non-Compliance: enforcement actions can include seeking injunctions, restitution, profit, and data disgorgement. Violators could face a civil penalty of $5,000 per violation

For a good breakdown.

Business Considerations

• Employers should assess usage and determine the extent to which minors are using your services.
• Employers should identify risks and evaluate potential online risks that may arise from minors using your services.
• Employers should implement measures to mitigate these risks, including mechanisms for parental consent, parental control tools, moderation efforts, and other protections.
• Employers should avoid misuse of data and refrain from using minors’ personal information for marketing or other purposes outside of providing them with the services they have requested unless permitted by applicable laws.
• Employers should secure data, implement technical and organizational measures to secure minors’ personal information, and ensure that your service providers adhere to the same regulatory obligations that apply to you.
• Employers should be aware to

Source References

• The New York Child Data Protection Act (S7695) 
• New York Press Release

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.