What's happening
This bill prohibits internet service providers in New York from disclosing subscribers' personal information without consent and imposes penalties for violations.
Why it matters
Broad Definition of Personal Information. The bill defines personal information expansively, including not just names and addresses but also data like internet searches, browser caches, medical conditions, and even the names and ages of children. This means internet service providers (ISPs) must protect a wide array of sensitive subscriber details.
Affirmative Consent Required. ISPs cannot sell, share, or transfer most subscriber information without explicit written or emailed permission from the subscriber. This shifts control over personal data from ISPs to consumers, potentially reducing unwanted data exploitation or targeted advertising.
Subscriber Rights and Transparency. The bill requires ISPs to inform subscribers of their rights under this law, including the ability to keep their email address confidential upon request. This transparency empowers users to make informed choices about their privacy.
Anti-Retaliation and Enforcement Provisions. ISPs are prohibited from penalizing subscribers—financially or by lowering service quality—if they refuse to share their data. Violations are treated as misdemeanors with fines imposed per incident, creating a financial deterrent for non-compliance and offering potential recourse for consumers.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Internet service providers
Providers would have to keep subscriber personal information confidential unless authorized in writing or by email, notify subscribers of their rights, and face misdemeanor penalties and fines of $500 to $1,000 per violation.
Internet subscribers
Subscribers could refuse to allow sharing of their personal information without facing extra charges or reduced service quality or speed, but would need to request confidentiality for their email addresses.
Businesses receiving subscriber data from internet providers
Access to information such as internet searches, browser caches, financial details and medical conditions would depend on subscribers’ written or emailed permission, with separate rules for email addresses.
Headline styles
Ban ISP Data Sales
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to consumer protection
- Returned to senate
- Died in assembly
- Referred to consumer affairs and protection
- Delivered to assembly
- Passed senateVote 62–0
- Ordered to third reading cal.1821
- Committee discharged and committed to rules
- Referred to consumer protection
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
5245
2019-2020 Regular Sessions
IN SENATE
April 18, 2019
Introduced by Sen. KENNEDY -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to the sale of personal information by an internet service provider
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 349-f to read as follows:
§ 349-f. Sale, transfer, or sharing of personal information by an internet service provider. 1. As used in this section:
(a) "Personal information" shall mean any information that, when it is disclosed, identifies, describes, or is able to be associated with an individual and includes, but is not limited to, the following:
(i) an individual's name and address;
(ii) information pertaining to creditworthiness, assets, income or liabilities;
(iii) age or date of birth;
(iv) names of children;
(v) electronic mail or other addresses of children;
(vi) number of children;
(vii) the age or gender of children;
(viii) height;
(ix) weight;
(x) race;
(xi) religion;
(xii) occupation;
(xiii) telephone number;
(xiv) education;
(xv) political party affiliation;
(xvi) medical condition;
(xvii) drugs, therapies, or medical products or equipment used;
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD03958-01-9
S. 5245 2
(xviii) the kind of product the customer purchased, leased, or rented;
(xix) real property purchased, leased, or rented;
(xx) the kind of service provided;
(xxi) social security number;
(xxii) bank account number;
(xxiii) credit card number;
(xxiv) debit card number;
(xxv) bank or investment account, debit card, or credit card balance;
(xxvi) payment history;
(xxvii) internet searches; or
(xxviii) browser cache.
(b) "Provider of internet service" shall mean any person, business or organization qualified to do business in this state that provides individuals, corporations, or other entities with the ability to connect to the internet through equipment that is located in this state.
2. A provider of internet service shall keep confidential:
(a) all personal information concerning a subscriber, other than the electronic mail address of the subscriber, unless the subscriber gives permission, in writing or by electronic mail, to the provider of internet service to disclose the information; and
(b) the electronic mail address of a subscriber, if the subscriber requests, in writing or by electronic mail, to have the electronic mail address of the subscriber kept confidential. Upon receiving such a request from a subscriber, a provider of internet service shall keep confidential the electronic mail address of the subscriber, unless the subscriber gives permission, in writing or by electronic mail, to the provider of internet service to disclose the electronic mail address of the subscriber.
3. A provider of internet service shall provide notice of the requirements of subdivision two of this section to each of its subscribers. The notice must include, without limitation, a conspicuous statement that a subscriber may request, in writing or by electronic mail, to have the electronic mail address of the subscriber kept confidential.
4. A provider of internet service shall not add a supplemental charge or in any way penalize a subscriber either financially or in quality or speed of delivery for choosing not to allow for the sharing of personal information.
5. A provider of internet service who violates any provision of this section shall be guilty of a misdemeanor and shall be subject to a fine of not less than five hundred dollars or more than one thousand dollars for each violation.
§ 2. This act shall take effect immediately.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to the sale of personal information by an internet service provider
Purpose
To prohibit internet service providers from selling the private informa- tion of consumers in New York State without consumers providing proper notice or risking the quality of their service.
Summary of provisions
Section 1. Amends the general business law by adding a new section § 349-f.
1. Prohibits internet service providers from selling a specified sched- ule of private data without proper notice.
2. Prevents providers from penalizing a consumer who does not authorize the sharing their private data including but not limited to imposing supplemental charges, decreasing bandwidth resulting in reduced speeds or any other measure that would diminish the quality or accessibility of internet services.
3. Establishes that the violation of any provision set out in this section results in the penalty of an unclassified misdemeanor carrying a fine of $1000 for each individual violation.
Section 2. Effective date.
Existing law
New law
Justification
New York State is one of the most connected states, in terms of internet access, in the nation. New York is on track for all residents to have highspeed internet access by the end of 2018. New York must act proac- tively and establishing provisions preventing violations of consumer privacy is imperative.
Currently, providers are able to sell the majority of data they collect from consumer's internet browsing history and caches to third parties without providing explicit notification to customers.
This information can reveal potentially sensitive information to employ- ers, associates, advertisers, and more. This can have negative conse- quences socially and financially for impacted individuals.
Ongoing changes at the federal level have opened the door to consumers unknowingly sacrificing their privacy and their ability to control how their most sensitive information is used.
This legislation would prevent the sale of consumer's private informa- tion by internet service providers, without their consent. It also prohibits those same providers from using coercive tactics to get customers to agree to share data, such as imposing additional penalties or reducing the speed or quality of service.
Legislative history
2017 S5516/A7495 died in Consumer Protections
Fiscal implications
None
Effective date
This act shall take effect immediately
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.