NY State Senate Bill 2025-S8641

Current Bill Status - In Senate Committee Internet And Technology Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

Date of Action	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 07, 2026	referred to internet and technology

2025-S8641 (ACTIVE) - Details

Current Committee:: Senate Internet And Technology
Law Section:: General Business Law
Laws Affected:: Add Art 39-FFF §§899-ss - 890-uu, Gen Bus L

2025-S8641 (ACTIVE) - Summary

Provides website and mobile application users the right to refuse non-essential cookies; prevents operators from making additional requests for the use of non-essential cookies.

2025-S8641 (ACTIVE) - Sponsor Memo

                                 
BILL NUMBER: S8641

SPONSOR: MAY
 
TITLE OF BILL:

An act to amend the general business law, in relation to providing
website and mobile application users the right to refuse non-essential
cookies

 
PURPOSE OR GENERAL IDEA OF BILL:

This bill establishes the right of New York State website and mobile
application users to refuse non-essential cookies and requires operators
to provide a clear, immediate mechanism to do so.

 
SUMMARY OF PROVISIONS:

The bill adds a new article to the General Business Law addressing non-
essential cookies on websites and mobile applications. T

The bill defines "cookies" as small text files created when users visit
websites or apps. "Essential cookies" are strictly necessary for basic

functionality like security. "Non-essential cookies" are used for
purposes like data analytics and marketing. It requires website and app
operators to get permission before using non-essential cookies. Opera-
tors must give users a clear option to reject non-essential cookies,
displayed just as prominently as the option to accept them. The reject
button must say "Reject Non-Essential Cookies" or similar language.
Users must be able to refuse or turn off non-essential cookies at any
time. Operators must provide a clear privacy notice that explains what
essential and non-essential cookies do and what happens if a user
rejects non-essential cookies. Once a user rejects non-essential cook-
ies, operators cannot ask again unless the user later wants to enable
cookies or a feature that needs them.

The Attorney General is authorized to enforce violations through actions
for injunctive relief, restitution, disgorgement, damages, and civil
penalties of up to five thousand dollars per violation.

 
JUSTIFICATION:

Current practice on many websites and mobile applications requires users
to navigate multiple steps, confusing interfaces, or deliberately
obscured options to refuse non-essential cookies. Users are frequently
presented with a prominent "Accept All" button while the option to
reject cookies is buried in settings menus or presented in smaller, less
visible text. This design pattern prioritizes data collection over user
choice.

Non-essential cookies are used for data analytics, marketing, and track-
ing user behavior across websites. "While these functions may benefit
operators, they are not required for basic website functionality. Users
have a legitimate interest in refusing data collection that is not
necessary to access the services they seek.

This bill ensures that refusing non-essential cookies is as simple as
accepting them. By requiring operators to present refusal options at the
same level and in the same configuration as acceptance options, the bill
eliminates design tactics that steer users toward consent.  The bill
also prevents operators from repeatedly asking users to reconsider their
decision, a practice that burdens users and undermines the effectiveness
of their initial refusal.

The enforcement mechanism provides the Attorney General with authority
to address violations and impose penalties sufficient to deter non-com-
pliance.

 
PRIOR LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None.

 
EFFECTIVE DATE:
This act takes effect ninety days after becoming law.

2025-S8641 (ACTIVE) - Bill Text download pdf

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   8641
 
                             I N  S E N A T E
 
                              January 7, 2026
                                ___________
 
 Introduced  by  Sen.  MAY  --  read  twice and ordered printed, and when
   printed to be committed to the Committee on Internet and Technology
 
 AN ACT to amend the general  business  law,  in  relation  to  providing
   website and mobile application users the right to refuse non-essential
   cookies
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new article
 39-FFF to read as follows:
                              ARTICLE 39-FFF
                       NON-ESSENTIAL COOKIES PRIVACY
 SECTION 899-SS. DEFINITIONS.
         890-TT. RIGHT TO REFUSE NON-ESSENTIAL COOKIES.
         890-UU. ENFORCEMENT.
   § 899-SS. DEFINITIONS. 1. AS USED IN THIS ARTICLE, THE FOLLOWING TERMS
 SHALL HAVE THE FOLLOWING MEANINGS:
   (A) "COOKIE" MEANS A SMALL TEXT FILE A WEB BROWSER CREATES WHEN A USER
 VISITS A WEBSITE OR MOBILE APPLICATION.
   (B) "ESSENTIAL COOKIES" MEANS A COOKIE STRICTLY NECESSARY TO  MAINTAIN
 BASIC  WEBSITE  OR  MOBILE  APPLICATION FUNCTIONALITY, INCLUDING BUT NOT
 LIMITED TO, SECURITY AND NETWORK MANAGEMENT.
   (C) "NON-ESSENTIAL COOKIES" MEANS A  COOKIE  NOT  REQUIRED  FOR  BASIC
 WEBSITE  OR MOBILE APPLICATION FUNCTIONALITY, INCLUDING, BUT NOT LIMITED
 TO, DATA ANALYTICS, MARKETING, AND USER PREFERENCES.
   (D) "USER" MEANS A USER OF A WEBSITE OR MOBILE APPLICATION IN NEW YORK
 STATE, NOT ACTING AS AN OPERATOR, AGENT, OR AFFILIATE OF THE OPERATOR OF
 SUCH WEBSITE OR MOBILE APPLICATION, OR ANY PORTION THEREOF.
   (E) "OPERATOR" MEANS ANY  PERSON,  BUSINESS,  ORGANIZATION,  OR  OTHER
 LEGAL ENTITY WHO OPERATES OR PROVIDES A WEBSITE OR MOBILE APPLICATION IN
 WHICH  DATA  CONCERNING  RESIDENTS OF NEW YORK STATE IS COLLECTED, PROC-
 ESSED, STORED, OR OTHERWISE OBTAINED.
   (F) "CONSENT" MEANS AN AFFIRMATIVE ACT BY A USER THAT CLEARLY COMMUNI-
 CATES THE USER'S FREELY GIVEN, SPECIFIC, AND  UNAMBIGUOUS  AUTHORIZATION
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD14240-01-5

 S. 8641                             2
 
 FOR  AN  ACT  OR  PRACTICE  AFTER HAVING BEEN INFORMED, IN RESPONSE TO A
 SPECIFIC REQUEST FROM AN OPERATOR.
   § 899-TT. RIGHT TO REFUSE NON-ESSENTIAL COOKIES. 1. AN OPERATOR SHALL:
   (A)  REQUIRE CONSENT FROM A USER TO USE ANY NON-ESSENTIAL COOKIES ON A
 WEBSITE OR MOBILE APPLICATION;
   (B) PRESENT TO THE USER, IN A CLEAR AND  CONSPICUOUS  MANNER,  WITHOUT
 ADDITIONAL  STEPS  OR DELAY, THE OPTION TO REFUSE NON-ESSENTIAL COOKIES.
 SUCH REFUSAL OPTION SHALL  FEATURE  A  PROMINENT  "REJECT  NON-ESSENTIAL
 COOKIES"  SELECTION  DISPLAYED AT THE SAME LEVEL AND IN THE SAME CONFIG-
 URATION AS A SELECTION TO "ACCEPT" OR OTHERWISE CONSENT TO NON-ESSENTIAL
 COOKIES;
   (C) PROVIDE THE USER WITH A CONTINUOUS MECHANISM TO REFUSE OR  DISABLE
 NON-ESSENTIAL COOKIES AT ANY TIME; AND
   (D)  PRESENT  A  PRIVACY NOTICE, IN A CLEAR AND CONSPICUOUS MANNER, TO
 THE USER. SUCH PRIVACY NOTICE SHALL:
   (I) BE CLEAR AND PROMINENT IN APPEARANCE;
   (II) USE CONCISE, CLEAR, AND PLAIN LANGUAGE;
   (III) EXPLAIN THE ROLE OF ESSENTIAL COOKIES AND NON-ESSENTIAL COOKIES;
 AND
   (IV) DESCRIBE THE RESULTS OF A USER'S DECISION TO REJECT NON-ESSENTIAL
 COOKIES.
   2. IT SHALL BE UNLAWFUL FOR AN OPERATOR TO  MAKE  ADDITIONAL  REQUESTS
 FOR THE USE OF NON-ESSENTIAL COOKIES AFTER A USER'S INITIAL REJECTION OF
 NON-ESSENTIAL  COOKIES,  UNLESS SUCH USER LATER SEEKS TO CONSENT TO NON-
 ESSENTIAL COOKIES OR ENABLES A FEATURE THAT REQUIRES ADDITIONAL COOKIES.
   § 899-UU. ENFORCEMENT. ON OR AFTER THE EFFECTIVE DATE OF THIS ARTICLE,
 WHENEVER IT APPEARS TO THE ATTORNEY GENERAL, UPON  COMPLAINT  OR  OTHER-
 WISE,  THAT  ANY OPERATOR, WITHIN OR OUTSIDE THE STATE, HAS VIOLATED THE
 PROVISIONS OF THIS ARTICLE, THE ATTORNEY GENERAL MAY BRING AN ACTION  OR
 SPECIAL  PROCEEDING IN THE NAME AND ON BEHALF OF THE PEOPLE OF THE STATE
 OF NEW YORK TO ENJOIN ANY SUCH VIOLATION, TO OBTAIN RESTITUTION  OF  ANY
 MONEYS   OR  PROPERTY  OBTAINED  DIRECTLY  OR  INDIRECTLY  BY  ANY  SUCH
 VIOLATION, TO OBTAIN DISGORGEMENT  OF  ANY  PROFITS  OR  GAINS  OBTAINED
 DIRECTLY  OR  INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN DAMAGES CAUSED
 DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN CIVIL  PENALTIES
 OF  UP  TO  FIVE  THOUSAND DOLLARS PER VIOLATION, AND TO OBTAIN ANY SUCH
 OTHER AND FURTHER RELIEF AS THE COURT MAY DEEM PROPER, INCLUDING PRELIM-
 INARY RELIEF.
   § 2. This act shall take effect on the ninetieth day  after  it  shall
 have become a law. Effective immediately, the addition, amendment and/or
 repeal  of  any  rule  or regulation necessary for the implementation of
 this act on its effective date are authorized to be made  and  completed
 on or before such effective date.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Find your Senator and share your views on important issues.

Do you support this bill?

Senate Bill S8641

Sponsored By

Current Bill Status - In Senate Committee Internet And Technology Committee

Actions

2025-S8641 (ACTIVE) - Details

2025-S8641 (ACTIVE) - Summary

2025-S8641 (ACTIVE) - Sponsor Memo

2025-S8641 (ACTIVE) - Bill Text download pdf

Comments

Do you support this bill?

Get Status Alerts for 2025-S8641

Senate Bill S8641

Share this bill

Sponsored By

Rachel May

Current Bill Status - In Senate Committee Internet And Technology Committee

Actions

2025-S8641 (ACTIVE) - Details

2025-S8641 (ACTIVE) - Summary

2025-S8641 (ACTIVE) - Sponsor Memo

2025-S8641 (ACTIVE) - Bill Text download pdf

Comments