Read the full stored bill text
S T A T E O F N E W Y O R K
________________________________________________________________________
8641
I N S E N A T E
January 7, 2026
___________
Introduced by Sen. MAY -- read twice and ordered printed, and when
printed to be committed to the Committee on Internet and Technology
AN ACT to amend the general business law, in relation to providing
website and mobile application users the right to refuse non-essential
cookies
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
1 Section 1. The general business law is amended by adding a new article
2 39-FFF to read as follows:
3 ARTICLE 39-FFF
4 NON-ESSENTIAL COOKIES PRIVACY
5 SECTION 899-SS. DEFINITIONS.
6 890-TT. RIGHT TO REFUSE NON-ESSENTIAL COOKIES.
7 890-UU. ENFORCEMENT.
8 § 899-SS. DEFINITIONS. 1. AS USED IN THIS ARTICLE, THE FOLLOWING TERMS
9 SHALL HAVE THE FOLLOWING MEANINGS:
10 (A) "COOKIE" MEANS A SMALL TEXT FILE A WEB BROWSER CREATES WHEN A USER
11 VISITS A WEBSITE OR MOBILE APPLICATION.
12 (B) "ESSENTIAL COOKIES" MEANS A COOKIE STRICTLY NECESSARY TO MAINTAIN
13 BASIC WEBSITE OR MOBILE APPLICATION FUNCTIONALITY, INCLUDING BUT NOT
14 LIMITED TO, SECURITY AND NETWORK MANAGEMENT.
15 (C) "NON-ESSENTIAL COOKIES" MEANS A COOKIE NOT REQUIRED FOR BASIC
16 WEBSITE OR MOBILE APPLICATION FUNCTIONALITY, INCLUDING, BUT NOT LIMITED
17 TO, DATA ANALYTICS, MARKETING, AND USER PREFERENCES.
18 (D) "USER" MEANS A USER OF A WEBSITE OR MOBILE APPLICATION IN NEW YORK
19 STATE, NOT ACTING AS AN OPERATOR, AGENT, OR AFFILIATE OF THE OPERATOR OF
20 SUCH WEBSITE OR MOBILE APPLICATION, OR ANY PORTION THEREOF.
21 (E) "OPERATOR" MEANS ANY PERSON, BUSINESS, ORGANIZATION, OR OTHER
22 LEGAL ENTITY WHO OPERATES OR PROVIDES A WEBSITE OR MOBILE APPLICATION IN
23 WHICH DATA CONCERNING RESIDENTS OF NEW YORK STATE IS COLLECTED, PROC-
24 ESSED, STORED, OR OTHERWISE OBTAINED.
25 (F) "CONSENT" MEANS AN AFFIRMATIVE ACT BY A USER THAT CLEARLY COMMUNI-
26 CATES THE USER'S FREELY GIVEN, SPECIFIC, AND UNAMBIGUOUS AUTHORIZATION
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD14240-01-5
S. 8641 2
1 FOR AN ACT OR PRACTICE AFTER HAVING BEEN INFORMED, IN RESPONSE TO A
2 SPECIFIC REQUEST FROM AN OPERATOR.
3 § 899-TT. RIGHT TO REFUSE NON-ESSENTIAL COOKIES. 1. AN OPERATOR SHALL:
4 (A) REQUIRE CONSENT FROM A USER TO USE ANY NON-ESSENTIAL COOKIES ON A
5 WEBSITE OR MOBILE APPLICATION;
6 (B) PRESENT TO THE USER, IN A CLEAR AND CONSPICUOUS MANNER, WITHOUT
7 ADDITIONAL STEPS OR DELAY, THE OPTION TO REFUSE NON-ESSENTIAL COOKIES.
8 SUCH REFUSAL OPTION SHALL FEATURE A PROMINENT "REJECT NON-ESSENTIAL
9 COOKIES" SELECTION DISPLAYED AT THE SAME LEVEL AND IN THE SAME CONFIG-
10 URATION AS A SELECTION TO "ACCEPT" OR OTHERWISE CONSENT TO NON-ESSENTIAL
11 COOKIES;
12 (C) PROVIDE THE USER WITH A CONTINUOUS MECHANISM TO REFUSE OR DISABLE
13 NON-ESSENTIAL COOKIES AT ANY TIME; AND
14 (D) PRESENT A PRIVACY NOTICE, IN A CLEAR AND CONSPICUOUS MANNER, TO
15 THE USER. SUCH PRIVACY NOTICE SHALL:
16 (I) BE CLEAR AND PROMINENT IN APPEARANCE;
17 (II) USE CONCISE, CLEAR, AND PLAIN LANGUAGE;
18 (III) EXPLAIN THE ROLE OF ESSENTIAL COOKIES AND NON-ESSENTIAL COOKIES;
19 AND
20 (IV) DESCRIBE THE RESULTS OF A USER'S DECISION TO REJECT NON-ESSENTIAL
21 COOKIES.
22 2. IT SHALL BE UNLAWFUL FOR AN OPERATOR TO MAKE ADDITIONAL REQUESTS
23 FOR THE USE OF NON-ESSENTIAL COOKIES AFTER A USER'S INITIAL REJECTION OF
24 NON-ESSENTIAL COOKIES, UNLESS SUCH USER LATER SEEKS TO CONSENT TO NON-
25 ESSENTIAL COOKIES OR ENABLES A FEATURE THAT REQUIRES ADDITIONAL COOKIES.
26 § 899-UU. ENFORCEMENT. ON OR AFTER THE EFFECTIVE DATE OF THIS ARTICLE,
27 WHENEVER IT APPEARS TO THE ATTORNEY GENERAL, UPON COMPLAINT OR OTHER-
28 WISE, THAT ANY OPERATOR, WITHIN OR OUTSIDE THE STATE, HAS VIOLATED THE
29 PROVISIONS OF THIS ARTICLE, THE ATTORNEY GENERAL MAY BRING AN ACTION OR
30 SPECIAL PROCEEDING IN THE NAME AND ON BEHALF OF THE PEOPLE OF THE STATE
31 OF NEW YORK TO ENJOIN ANY SUCH VIOLATION, TO OBTAIN RESTITUTION OF ANY
32 MONEYS OR PROPERTY OBTAINED DIRECTLY OR INDIRECTLY BY ANY SUCH
33 VIOLATION, TO OBTAIN DISGORGEMENT OF ANY PROFITS OR GAINS OBTAINED
34 DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN DAMAGES CAUSED
35 DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN CIVIL PENALTIES
36 OF UP TO FIVE THOUSAND DOLLARS PER VIOLATION, AND TO OBTAIN ANY SUCH
37 OTHER AND FURTHER RELIEF AS THE COURT MAY DEEM PROPER, INCLUDING PRELIM-
38 INARY RELIEF.
39 § 2. This act shall take effect on the ninetieth day after it shall
40 have become a law. Effective immediately, the addition, amendment and/or
41 repeal of any rule or regulation necessary for the implementation of
42 this act on its effective date are authorized to be made and completed
43 on or before such effective date.