(B) AGREEMENT OBTAINED THROUGH THE USE OF A USER INTERFACE DESIGNED OR
MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING OR IMPAIRING USER
AUTONOMY, DECISION MAKING, OR CHOICE.
4. "COVERED ENTITY" MEANS ANY INDIVIDUAL, PARTNERSHIP, CORPORATION,
LIMITED LIABILITY COMPANY, ASSOCIATION, OR OTHER GROUP, HOWEVER ORGAN-
IZED. A COVERED ENTITY DOES NOT INCLUDE A STATE OR LOCAL GOVERNMENT
AGENCY, OR ANY COURT OF NEW YORK, A CLERK OF THE COURT, OR A JUDGE OR
JUSTICE THEREOF. A COVERED ENTITY DOES NOT INCLUDE AN INDIVIDUAL ACTING
IN A NON-COMMERCIAL CONTEXT. A COVERED ENTITY INCLUDES ALL AGENTS OF THE
ENTITY.
5. "DEVICE" MEANS A MOBILE TELEPHONE OR ANY OTHER ELECTRONIC DEVICE
THAT IS OR MAY COMMONLY BE CARRIED BY OR ON AN INDIVIDUAL AND IS CAPABLE
OF CONNECTING TO A CELLULAR, BLUETOOTH, OR OTHER WIRELESS NETWORK.
6. "DISCLOSE" MEANS TO MAKE LOCATION INFORMATION AVAILABLE TO A THIRD
PARTY, INCLUDING BUT NOT LIMITED TO SHARING, PUBLISHING, RELEASING,
TRANSFERRING, DISSEMINATING, PROVIDING ACCESS TO, OR OTHERWISE COMMUNI-
CATING SUCH LOCATION INFORMATION ORALLY, IN WRITING, ELECTRONICALLY, OR
BY ANY OTHER MEANS.
7. "INDIVIDUAL" MEANS A PERSON LOCATED IN THE STATE OF NEW YORK.
8. "LOCATION INFORMATION" MEANS INFORMATION DERIVED FROM A DEVICE OR
FROM INTERACTIONS BETWEEN DEVICES, WITH OR WITHOUT THE KNOWLEDGE OF THE
USER AND REGARDLESS OF THE TECHNOLOGICAL METHOD USED, THAT PERTAINS TO
OR DIRECTLY OR INDIRECTLY REVEALS THE PRESENT OR PAST GEOGRAPHICAL
LOCATION OF AN INDIVIDUAL OR DEVICE WITHIN THE STATE OF NEW YORK WITH
SUFFICIENT PRECISION TO IDENTIFY STREET-LEVEL LOCATION INFORMATION WITH-
IN A RANGE OF ONE THOUSAND EIGHT HUNDRED FIFTY FEET OR LESS. LOCATION
INFORMATION INCLUDES BUT IS NOT LIMITED TO: (A) AN INTERNET PROTOCOL
ADDRESS CAPABLE OF REVEALING THE PHYSICAL OR GEOGRAPHICAL LOCATION OF AN
INDIVIDUAL; (B) GLOBAL POSITIONING SYSTEM (GPS) COORDINATES; AND (C)
CELL-SITE LOCATION INFORMATION. THIS TERM DOES NOT INCLUDE LOCATION
INFORMATION IDENTIFIABLE OR DERIVED SOLELY FROM THE VISUAL CONTENT OF A
LEGALLY OBTAINED IMAGE, INCLUDING THE LOCATION OF THE DEVICE THAT
CAPTURED SUCH IMAGE, OR PUBLICLY POSTED WORDS.
9. "LOCATION PRIVACY POLICY" MEANS A DESCRIPTION OF THE POLICIES,
PRACTICES, AND PROCEDURES CONTROLLING A COVERED ENTITY'S COLLECTION,
PROCESSING, MANAGEMENT, STORAGE, RETENTION, AND DELETION OF LOCATION
INFORMATION.
10. "MONETIZE" MEANS TO COLLECT, PROCESS, OR DISCLOSE AN INDIVIDUAL'S
LOCATION INFORMATION FOR PROFIT OR IN EXCHANGE FOR MONETARY OR OTHER
CONSIDERATION. THIS TERM INCLUDES BUT IS NOT LIMITED TO SELLING, RENT-
ING, TRADING, OR LEASING LOCATION INFORMATION.
11. "PERSON" MEANS ANY NATURAL PERSON.
12. "PERMISSIBLE PURPOSE" MEANS ONE OF THE FOLLOWING PURPOSES:
(A) THE PROVISION OF A PRODUCT, SERVICE, OR SERVICE FEATURE TO THE
INDIVIDUAL TO WHOM THE LOCATION INFORMATION PERTAINS WHEN THAT INDIVID-
UAL REQUESTED THE PROVISION OF SUCH PRODUCT, SERVICE, OR SERVICE FEATURE
BY SUBSCRIBING TO, CREATING AN ACCOUNT, OR OTHERWISE CONTRACTING WITH A
COVERED ENTITY;
(B) INITIATION, MANAGEMENT, EXECUTION, OR COMPLETION OF A FINANCIAL OR
COMMERCIAL TRANSACTION OR FULFILL AN ORDER FOR SPECIFIC PRODUCTS OR
SERVICES REQUESTED BY AN INDIVIDUAL, INCLUDING ANY ASSOCIATED ROUTINE
ADMINISTRATIVE, OPERATIONAL, AND ACCOUNT-SERVICING ACTIVITY SUCH AS
BILLING, SHIPPING, DELIVERY, STORAGE, AND ACCOUNTING;
(C) COMPLIANCE WITH AN OBLIGATION UNDER FEDERAL OR STATE LAW; OR
A. 8729 3
(D) RESPONSE TO AN EMERGENCY SERVICE AGENCY, AN EMERGENCY ALERT, A 911
COMMUNICATION, OR ANY OTHER COMMUNICATION REPORTING AN IMMINENT THREAT
TO HUMAN LIFE.
13. "PROCESS" MEANS TO PERFORM ANY ACTION OR SET OF ACTIONS ON OR WITH
LOCATION INFORMATION, INCLUDING BUT NOT LIMITED TO COLLECTING, ACCESS-
ING, USING, STORING, RETAINING, ANALYZING, CREATING, GENERATING, AGGRE-
GATING, ALTERING, CORRELATING, OPERATING ON, RECORDING, MODIFYING,
ORGANIZING, STRUCTURING, DISPOSING OF, DESTROYING, DE-IDENTIFYING, OR
OTHERWISE MANIPULATING LOCATION INFORMATION. THIS TERM DOES NOT INCLUDE
DISCLOSING LOCATION INFORMATION.
14. "REASONABLY UNDERSTANDABLE" MEANS OF LENGTH AND COMPLEXITY SUCH
THAT AN INDIVIDUAL WITH AN EIGHTH-GRADE READING LEVEL, AS ESTABLISHED BY
THE DEPARTMENT OF EDUCATION, CAN READ AND COMPREHEND.
15. "SERVICE FEATURE" MEANS A DISCRETE ASPECT OF A SERVICE PROVIDED BY
A COVERED ENTITY, INCLUDING BUT NOT LIMITED TO REAL-TIME DIRECTIONS,
REAL-TIME WEATHER, AND IDENTITY AUTHENTICATION.
16. "SERVICE PROVIDER" MEANS AN INDIVIDUAL, PARTNERSHIP, CORPORATION,
LIMITED LIABILITY COMPANY, ASSOCIATION, OR OTHER GROUP, HOWEVER ORGAN-
IZED, THAT COLLECTS, PROCESSES, OR TRANSFERS LOCATION INFORMATION FOR
THE SOLE PURPOSE OF, AND ONLY TO THE EXTENT THAT SUCH SERVICE PROVIDER
IS, CONDUCTING BUSINESS ACTIVITIES ON BEHALF OF, FOR THE BENEFIT OF, AT
THE DIRECTION OF, AND UNDER CONTRACTUAL AGREEMENT WITH A COVERED ENTITY.
17. "THIRD PARTY" MEANS ANY COVERED ENTITY OR PERSON OTHER THAN: (A) A
COVERED ENTITY THAT COLLECTED OR PROCESSED LOCATION INFORMATION IN
ACCORDANCE WITH THIS CHAPTER OR ITS SERVICE PROVIDERS; OR (B) THE INDI-
VIDUAL TO WHOM THE LOCATION INFORMATION PERTAINS. THIS TERM DOES NOT
INCLUDE GOVERNMENT ENTITIES.
§ 899-TT. PROTECTION OF LOCATION INFORMATION. 1. IT SHALL BE UNLAWFUL
FOR A COVERED ENTITY TO COLLECT OR PROCESS AN INDIVIDUAL'S LOCATION
INFORMATION EXCEPT FOR A PERMISSIBLE PURPOSE. PRIOR TO COLLECTING OR
PROCESSING AN INDIVIDUAL'S LOCATION INFORMATION FOR ONE OF THOSE PERMIS-
SIBLE PURPOSES, A COVERED ENTITY SHALL PROVIDE THE INDIVIDUAL WITH A
COPY OF THE LOCATION PRIVACY POLICY AND OBTAIN CONSENT FROM THAT INDI-
VIDUAL; PROVIDED, HOWEVER, THAT THIS SHALL NOT BE REQUIRED WHEN THE
COLLECTION AND PROCESSING IS DONE IN:
(A) COMPLIANCE WITH AN OBLIGATION UNDER FEDERAL OR STATE LAW; OR
(B) IN RESPONSE TO AN EMERGENCY SERVICE AGENCY, AN EMERGENCY ALERT, A
911 COMMUNICATION, OR ANY OTHER COMMUNICATION REPORTING AN IMMINENT
THREAT TO HUMAN LIFE.
2. IF A COVERED ENTITY COLLECTS LOCATION INFORMATION FOR THE PROVISION
OF MULTIPLE PERMISSIBLE PURPOSES, IT SHALL BE MENTIONED IN THE LOCATION
PRIVACY POLICY AND INDIVIDUALS SHALL PROVIDE DISCRETE CONSENT FOR EACH
PURPOSE; PROVIDED, HOWEVER, THAT THIS SHALL NOT BE REQUIRED FOR THE
PURPOSE OF COLLECTING AND PROCESSING LOCATION INFORMATION TO COMPLY WITH
AN OBLIGATION UNDER FEDERAL OR STATE LAW OR TO RESPOND TO AN EMERGENCY
SERVICE AGENCY, AN EMERGENCY ALERT, A 911 COMMUNICATION, OR ANY OTHER
COMMUNICATION REPORTING AN IMMINENT THREAT TO HUMAN LIFE.
3. A COVERED ENTITY THAT DIRECTLY DELIVERS TARGETED ADVERTISEMENTS AS
PART OF ITS PRODUCT OR SERVICES SHALL PROVIDE INDIVIDUALS WITH A CLEAR,
CONSPICUOUS, AND SIMPLE MEANS TO OPT OUT OF THE PROCESSING OF THEIR
LOCATION INFORMATION FOR PURPOSES OF SELECTING AND DELIVERING TARGETED
ADVERTISEMENTS.
4. CONSENT PROVIDED UNDER THIS SECTION SHALL EXPIRE:
(A) AFTER ONE YEAR;
(B) WHEN THE INITIAL PURPOSE FOR PROCESSING THE INFORMATION HAS BEEN
SATISFIED; OR
A. 8729 4
(C) WHEN THE INDIVIDUAL REVOKES CONSENT, WHICHEVER OCCURS FIRST,
PROVIDED THAT CONSENT MAY BE RENEWED PURSUANT TO THE SAME PROCEDURES.
UPON EXPIRATION OF CONSENT, ANY LOCATION INFORMATION POSSESSED BY A
COVERED ENTITY SHALL BE PERMANENTLY DESTROYED.
5. IT SHALL BE UNLAWFUL FOR A COVERED ENTITY OR SERVICE PROVIDER THAT
LAWFULLY COLLECTS AND PROCESSES LOCATION INFORMATION TO:
(A) COLLECT MORE PRECISE LOCATION INFORMATION THAN NECESSARY TO CARRY
OUT THE PERMISSIBLE PURPOSE;
(B) RETAIN LOCATION INFORMATION LONGER THAN NECESSARY TO CARRY OUT THE
PERMISSIBLE PURPOSE;
(C) SELL, RENT, TRADE, OR LEASE LOCATION INFORMATION TO THIRD PARTIES;
(D) DERIVE OR INFER FROM LOCATION INFORMATION ANY DATA THAT IS NOT
NECESSARY TO CARRY OUT A PERMISSIBLE PURPOSE; OR
(E) DISCLOSE, CAUSE TO DISCLOSE, OR ASSIST WITH OR FACILITATE THE
DISCLOSURE OF AN INDIVIDUAL'S LOCATION INFORMATION TO THIRD PARTIES,
UNLESS SUCH DISCLOSURE IS NECESSARY TO CARRY OUT THE PERMISSIBLE PURPOSE
FOR WHICH THE INFORMATION WAS COLLECTED OR REQUESTED BY THE INDIVIDUAL
TO WHOM THE LOCATION DATA PERTAINS.
6. IT SHALL BE UNLAWFUL FOR A COVERED ENTITY OR SERVICE PROVIDERS TO
DISCLOSE LOCATION INFORMATION TO ANY FEDERAL, STATE, OR LOCAL GOVERNMENT
AGENCY OR OFFICIAL UNLESS:
(A) THE AGENCY OR OFFICIAL SERVES THE COVERED ENTITY OR SERVICE
PROVIDER WITH A VALID WARRANT OR ESTABLISHES THE EXISTENCE OF EXIGENT
CIRCUMSTANCES THAT MAKE IT IMPRACTICABLE TO OBTAIN A WARRANT;
(B) DISCLOSURE IS MANDATED UNDER FEDERAL OR STATE LAW, INCLUDING IN
RESPONSE TO A COURT ORDER OR LAWFULLY ISSUED AND PROPERLY SERVED SUBPOE-
NA OR CIVIL INVESTIGATIVE DEMAND UNDER STATE OR FEDERAL LAW; OR
(C) THE DATA SUBJECT REQUESTS SUCH DISCLOSURE.
7. A COVERED ENTITY SHALL MAINTAIN AND MAKE AVAILABLE TO THE DATA
SUBJECT A LOCATION PRIVACY POLICY, WHICH SHALL INCLUDE, AT A MINIMUM,
THE FOLLOWING:
(A) THE PERMISSIBLE PURPOSE FOR WHICH THE COVERED ENTITY IS COLLECT-
ING, PROCESSING, OR DISCLOSING ANY LOCATION INFORMATION;
(B) THE TYPE OF LOCATION INFORMATION COLLECTED, INCLUDING THE PRECI-
SION OF THE DATA;
(C) THE IDENTITIES OF SERVICE PROVIDERS WITH WHICH THE COVERED ENTITY
CONTRACTS WITH RESPECT TO LOCATION DATA;
(D) ANY DISCLOSURES OF LOCATION DATA NECESSARY TO CARRY OUT A PERMIS-
SIBLE PURPOSE AND THE IDENTITIES OF THE THIRD PARTIES TO WHOM THE
LOCATION INFORMATION COULD BE DISCLOSED;
(E) WHETHER THE COVERED ENTITY'S PRACTICES INCLUDE THE INTERNAL USE OF
LOCATION INFORMATION FOR PURPOSES OF TARGETED ADVERTISEMENT;
(F) THE DATA MANAGEMENT AND DATA SECURITY POLICIES GOVERNING LOCATION
INFORMATION; AND
(G) THE RETENTION SCHEDULE AND GUIDELINES FOR PERMANENTLY DELETING
LOCATION INFORMATION.
8. A COVERED ENTITY IN LAWFUL POSSESSION OF LOCATION INFORMATION SHALL
PROVIDE NOTICE TO INDIVIDUALS TO WHOM THAT INFORMATION PERTAINS OF ANY
CHANGE TO ITS LOCATION PRIVACY POLICY AT LEAST TWENTY BUSINESS DAYS
BEFORE THE CHANGE GOES INTO EFFECT, AND SHALL REQUEST AND OBTAIN CONSENT
BEFORE COLLECTING OR PROCESSING LOCATION INFORMATION IN ACCORDANCE WITH
THE NEW LOCATION PRIVACY POLICY.
9. IT SHALL BE UNLAWFUL FOR A GOVERNMENT ENTITY TO MONETIZE LOCATION
INFORMATION.
§ 899-UU. PROHIBITION AGAINST RETALIATION. A COVERED ENTITY SHALL NOT
TAKE ADVERSE ACTION AGAINST AN INDIVIDUAL BECAUSE THE INDIVIDUAL EXER-
A. 8729 5
CISED OR REFUSED TO WAIVE ANY OF SUCH INDIVIDUAL'S RIGHTS UNDER THIS
ARTICLE, UNLESS LOCATION DATA IS ESSENTIAL TO THE PROVISION OF THE GOOD,
SERVICE, OR SERVICE FEATURE THAT THE INDIVIDUAL REQUESTS, AND THEN ONLY
TO THE EXTENT THAT SUCH DATA IS ESSENTIAL. THIS PROHIBITION INCLUDES BUT
IS NOT LIMITED TO:
1. REFUSING TO PROVIDE A GOOD OR SERVICE TO THE INDIVIDUAL;
2. CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, INCLUDING
THROUGH THE USE OF DISCOUNTS OR OTHER BENEFITS OR IMPOSING PENALTIES; OR
3. PROVIDING A DIFFERENT LEVEL OR QUALITY OF GOODS OR SERVICES TO THE
INDIVIDUAL.
§ 899-VV. ENFORCEMENT. 1. A VIOLATION OF THIS CHAPTER OR A REGULATION
PROMULGATED UNDER THIS ARTICLE REGARDING AN INDIVIDUAL'S LOCATION INFOR-
MATION CONSTITUTES AN INJURY TO THAT INDIVIDUAL AND SHALL BE DEEMED AN
UNFAIR OR DECEPTIVE ACT OR PRACTICE IN THE CONDUCT OF TRADE OR COMMERCE.
2. ANY INDIVIDUAL ALLEGING A VIOLATION OF THIS CHAPTER BY A COVERED
ENTITY OR SERVICE PROVIDER MAY BRING A CIVIL ACTION IN THE SUPREME COURT
OR ANY COURT OF COMPETENT JURISDICTION; PROVIDED THAT, VENUE IN THE
SUPREME COURT SHALL BE IN THE COUNTY IN WHICH THE PLAINTIFF RESIDES OR
WAS LOCATED AT THE TIME OF ANY VIOLATION.
3. AN INDIVIDUAL PROTECTED BY THIS CHAPTER SHALL NOT BE REQUIRED, AS A
CONDITION OF SERVICE OR OTHERWISE, TO FILE AN ADMINISTRATIVE COMPLAINT
WITH THE ATTORNEY GENERAL OR TO ACCEPT MANDATORY ARBITRATION OF A CLAIM
ARISING UNDER THIS CHAPTER.
4. IN A CIVIL ACTION IN WHICH THE PLAINTIFF PREVAILS, THE COURT MAY
AWARD:
(A) ACTUAL DAMAGES, INCLUDING DAMAGES FOR EMOTIONAL DISTRESS, OR FIVE
THOUSAND DOLLARS PER VIOLATION, WHICHEVER IS GREATER;
(B) PUNITIVE DAMAGES; AND
(C) ANY OTHER RELIEF, INCLUDING BUT NOT LIMITED TO AN INJUNCTION OR
DECLARATORY JUDGMENT, THAT THE COURT DEEMS TO BE APPROPRIATE. THE COURT
SHALL CONSIDER EACH INSTANCE IN WHICH A COVERED ENTITY OR SERVICE
PROVIDER COLLECTS, PROCESSES, OR DISCLOSES LOCATION INFORMATION IN A
MANNER PROHIBITED BY THIS ARTICLE OR A REGULATION PROMULGATED UNDER THIS
ARTICLE AS CONSTITUTING A SEPARATE VIOLATION OF THIS CHAPTER OR REGU-
LATION PROMULGATED UNDER THIS ARTICLE. IN ADDITION TO ANY RELIEF
AWARDED, THE COURT SHALL AWARD REASONABLE ATTORNEY'S FEES AND COSTS TO
ANY PREVAILING PLAINTIFF.
5. THE ATTORNEY GENERAL MAY BRING AN ACTION AGAINST A COVERED ENTITY
OR SERVICE PROVIDER TO REMEDY VIOLATIONS OF THIS CHAPTER AND FOR OTHER
RELIEF THAT MAY BE APPROPRIATE.
6. ANY PROVISION OF A CONTRACT OR AGREEMENT OF ANY KIND, INCLUDING A
COVERED ENTITY'S TERMS OF SERVICE OR POLICIES, INCLUDING BUT NOT LIMITED
TO THE LOCATION PRIVACY POLICY, THAT PURPORTS TO WAIVE OR LIMIT IN ANY
WAY AN INDIVIDUAL'S RIGHTS UNDER THIS ARTICLE, INCLUDING BUT NOT LIMITED
TO ANY RIGHT TO A REMEDY OR MEANS OF ENFORCEMENT, SHALL BE DEEMED
CONTRARY TO STATE LAW AND SHALL BE VOID AND UNENFORCEABLE.
7. NO PRIVATE OR GOVERNMENT ACTION BROUGHT PURSUANT TO THIS ARTICLE
SHALL PRECLUDE ANY OTHER ACTION UNDER THIS ARTICLE OR ANY OTHER
PROVISION OF LAW.
§ 899-WW. RULEMAKING AUTHORITY. THE ATTORNEY GENERAL MAY PROMULGATE
SUCH RULES AND REGULATIONS AS ARE NECESSARY TO EFFECTUATE AND ENFORCE
THE PROVISIONS OF THIS ARTICLE.
§ 899-XX. APPLICATION. LOCATION INFORMATION COLLECTED, PROCESSED, AND
STORED PRIOR TO THE EFFECTIVE DATE OF THIS ARTICLE SHALL BE SUBJECT TO
THE PROVISIONS OF PARAGRAPHS (C) AND (E) OF SUBDIVISION FIVE AND OF
SUBDIVISION SIX OF SECTION THREE HUNDRED NINETY-NINE-TT OF THIS ARTICLE.
A. 8729 6
§ 2. This act shall take effect one year after it shall have become a
law. Effective immediately, the addition, amendment and/or repeal of
any rule or regulation necessary for the implementation of this act on
its effective date are authorized to be made and completed on or before
such effective date.