New York Child Data Protection Act Takes Effect

News Summary

The New York Child Data Protection Act (NYCDPA) is now in effect, establishing robust privacy regulations for minors under 18. This legislation restricts businesses from collecting personal data from minors without proper consent and emphasizes user autonomy. Companies must comply by understanding their user base and deleting data upon request. The act incorporates elements from existing laws, while also imposing penalties for non-compliance, highlighting New York’s commitment to the digital privacy of its youth.

New York City, NY – The New York Child Data Protection Act (NYCDPA) has officially gone into effect, introducing new regulations designed to enhance the privacy standards for minors under the age of 18. The law seeks to protect young individuals by restricting businesses from collecting or utilizing personal data from users in this age group without proper consent.

The NYCDPA stands out as unique, especially since New York has not yet adopted a comprehensive consumer privacy law. This targeted legislation specifically focuses on the protection of children’s and young adults’ digital privacy, establishing requirements for any business that operates websites or online services.

Under the NYCDPA, all “operators” are defined as entities that run websites, applications, or connected devices and who determine the purposes and methods of processing personal data. These operators are obligated to treat users as “covered users” if it is known that they are minors or if the service primarily targets minors. To comply with these guidelines, businesses must implement systems that differentiate between minor users and adults, such as through browser plug-ins or privacy settings.

Covered users have the right to revoke their consent at any time. In instances where consent is withdrawn or not initially granted, operators are prohibited from requesting consent again for at least one year. This provision ensures that minors maintain control over their personal information, reinforcing the focus on protecting their digital footprints.

Moreover, the NYCDPA stipulates that operators cannot downgrade service quality or raise prices if a covered user decides against providing consent. This regulation aims to deter companies from leveraging consent decisions to coerce users into granting approval for data collection, thus preserving user autonomy.

Another significant requirement is that operators must delete personal data if requested by the user. Furthermore, any subprocessors that handle this data must also remove it when the service concludes. This provision reinforces the commitment to safeguarding personal information and providing a straightforward process for users to manage their data.

Incorporating standards from the established Children’s Online Privacy Protection Act (COPPA), the NYCDPA extends its protections to users under the age of 13. Meanwhile, it maintains alignment with existing laws like the New York Education Law and FERPA, ensuring that children’s rights in educational settings remain intact.

Violations of the NYCDPA could result in significant civil penalties, with fines reaching up to $5,000 for each infraction. Notably, enforcement will consider the good-faith efforts of operators to comply with the law, allowing some leeway for businesses that demonstrate genuine attempts at compliance.

Businesses are encouraged to evaluate their services to ascertain whether they cater to individuals under 18 and to implement reliable identification methods for minor users. This assessment is critical as operators must adapt to the new landscape of data privacy.

To comply, companies should prioritize limited data processing activities by default and establish clear consent mechanisms for any non-essential data uses. Additionally, third parties that process minors’ data on behalf of businesses must adhere to the appropriate contractual safeguards as mandated by the NYCDPA.

To aid businesses, the New York Attorney General has released guidance to clarify any ambiguous provisions of the law and may use a tiered approach for enforcement based on how diligently operators strive to comply. The NYCDPA allows for a broader interpretation of what it means for services to be “primarily directed” at minors, granting flexibility in enforcement practices.

Additionally, the law indicates that processing personal data from minors aged 13 to 17 may occur without consent if strictly necessary for specific purposes, balancing privacy needs with operational requirements. Finally, the NYCDPA does not modify existing parental rights regarding data processing for services to which parents may consent on behalf of their children.

Deeper Dive: News & Info About This Topic

HERE Resources

Staten Island Faces Measles Vaccination Challenge
Measles Crisis Hits the U.S. – Parents Urged to Vaccinate

Additional Resources

• JD Supra: The New York Child Data Protection Act
• Inside Privacy: New York Attorney General Issues Guidance on NY Child Data Protection Act
• Ogletree: Key Takeaways from the Attorney General’s Implementation Guidance
• SI Live: Four New NY Laws Taking Effect
• Brooklyn Paper: Gounardes’ Landmark Child Data Protection Law
• Wikipedia: Data Privacy
• Google Search: New York Child Data Protection Act
• Google Scholar: New York Child Data Protection Act
• Encyclopedia Britannica: Data Privacy
• Google News: New York Child Data Protection Act