S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   7695
 
                        2023-2024 Regular Sessions
 
                             I N  S E N A T E
 
                             October 13, 2023
                                ___________
 
 Introduced by Sen. GOUNARDES -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN  ACT  to  amend the general business law, in relation to establishing
   the New York child data protection act
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new article
 39-FF to read as follows:
                               ARTICLE 39-FF
                    NEW YORK CHILD DATA PROTECTION ACT
 SECTION 899-EE. DEFINITIONS.
         899-FF. PRIVACY PROTECTION BY DEFAULT.
         899-GG. THIRD PARTIES.
         899-HH. ONGOING SAFEGUARDS.
         899-II. RESPECTING USER-PROVIDED AGE FLAGS.
         899-JJ. PROTECTIONS FOR THIRD-PARTY OPERATORS.
         899-KK. RULEMAKING AUTHORITY.
         899-LL. SCOPE.
         899-MM. REMEDIES.
   §  899-EE.  DEFINITIONS.  FOR  PURPOSES OF THIS ARTICLE, THE FOLLOWING
 TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   1. "COVERED USER" SHALL MEAN A USER  OF  A  WEBSITE,  ONLINE  SERVICE,
 ONLINE  APPLICATION, MOBILE APPLICATION, OR CONNECTED DEVICE, OR PORTION
 THEREOF, IN THE STATE OF NEW YORK WHO IS:
   (A) ACTUALLY KNOWN BY THE OPERATOR OF SUCH  WEBSITE,  ONLINE  SERVICE,
 ONLINE  APPLICATION,  MOBILE  APPLICATION,  OR  CONNECTED DEVICE TO BE A
 MINOR; OR
   (B) A USER OF A WEBSITE, ONLINE SERVICE,  ONLINE  APPLICATION,  MOBILE
 APPLICATION, OR CONNECTED DEVICE PRIMARILY DIRECTED TO MINORS.
   2. "MINOR" SHALL MEAN A NATURAL PERSON UNDER THE AGE OF EIGHTEEN.
   3. "OPERATOR" SHALL MEAN ANY PERSON:
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13150-04-3
              

 S. 7695                             2
 
   (A)  WHO  OPERATES  OR  PROVIDES  A  WEBSITE  ON  THE INTERNET, ONLINE
 SERVICE, ONLINE APPLICATION, MOBILE APPLICATION,  OR  CONNECTED  DEVICE;
 AND
   (B) WHO:
   (I)  COLLECTS OR MAINTAINS, EITHER DIRECTLY OR THROUGH ANOTHER PERSON,
 PERSONAL DATA FROM OR ABOUT THE USERS OF SUCH WEBSITE, SERVICE, APPLICA-
 TION, OR CONNECTED DEVICE;
   (II)  INTEGRATES  WITH  ANOTHER  WEBSITE,  SERVICE,  APPLICATION,   OR
 CONNECTED  DEVICE  AND DIRECTLY COLLECTS PERSONAL DATA FROM THE USERS OF
 SUCH WEBSITE, SERVICE, APPLICATION, OR CONNECTED DEVICE;
   (III) ALLOWS ANOTHER PERSON TO COLLECT  PERSONAL  DATA  DIRECTLY  FROM
 USERS OF SUCH WEBSITE, SERVICE, APPLICATION, OR CONNECTED DEVICE; OR
   (IV)  ALLOWS USERS OF SUCH WEBSITE, SERVICE, APPLICATION, OR CONNECTED
 DEVICE TO PUBLICLY DISCLOSE PERSONAL DATA.
   4. "PERSONAL DATA" SHALL  MEAN  ANY  DATA  THAT  IDENTIFIES  OR  COULD
 REASONABLY  BE  LINKED,  DIRECTLY OR INDIRECTLY, WITH A SPECIFIC NATURAL
 PERSON OR DEVICE.
   5. "PROCESS" OR "PROCESSING" SHALL MEAN AN OPERATION OR SET  OF  OPER-
 ATIONS  PERFORMED  ON  PERSONAL  DATA,  INCLUDING BUT NOT LIMITED TO THE
 COLLECTION,  USE,  ACCESS,  SHARING,   SALE,   MONETIZATION,   ANALYSIS,
 RETENTION,  CREATION,  GENERATION,  DERIVATION, RECORDING, ORGANIZATION,
 STRUCTURING, STORAGE,  DISCLOSURE,  TRANSMISSION,  DISPOSAL,  LICENSING,
 DESTRUCTION,  DELETION,  MODIFICATION,  OR  DEIDENTIFICATION OF PERSONAL
 DATA.
   6. "PRIMARILY  DIRECTED  TO  MINORS"  SHALL  MEAN  A  WEBSITE,  ONLINE
 SERVICE, ONLINE APPLICATION, MOBILE APPLICATION, OR CONNECTED DEVICE, OR
 A  PORTION  THEREOF,  THAT  IS  TARGETED  TO  MINORS.  A WEBSITE, ONLINE
 SERVICE, ONLINE APPLICATION, MOBILE APPLICATION, OR CONNECTED DEVICE, OR
 PORTION THEREOF, SHALL NOT BE DEEMED DIRECTED PRIMARILY TO MINORS SOLELY
 BECAUSE SUCH WEBSITE, ONLINE SERVICE, ONLINE APPLICATION, MOBILE  APPLI-
 CATION,  OR  CONNECTED DEVICE, OR PORTION THEREOF REFERS OR LINKS TO ANY
 OTHER WEBSITE, ONLINE SERVICE, ONLINE APPLICATION,  MOBILE  APPLICATION,
 OR  CONNECTED  DEVICE  DIRECTED  TO MINORS BY USING INFORMATION LOCATION
 TOOLS, INCLUDING A DIRECTORY, INDEX, REFERENCE,  POINTER,  OR  HYPERTEXT
 LINK. A WEBSITE, ONLINE SERVICE, ONLINE APPLICATION, MOBILE APPLICATION,
 OR  CONNECTED  DEVICE,  OR  PORTION THEREOF, SHALL BE DEEMED DIRECTED TO
 MINORS WHEN IT HAS ACTUAL KNOWLEDGE THAT IT IS COLLECTING PERSONAL  DATA
 OF  USERS DIRECTLY FROM USERS OF ANOTHER WEBSITE, ONLINE SERVICE, ONLINE
 APPLICATION, MOBILE APPLICATION, OR CONNECTED DEVICE PRIMARILY  DIRECTED
 TO MINORS.
   7.  "SELL"  SHALL  MEAN  TO  SHARE PERSONAL DATA FOR MONETARY OR OTHER
 VALUABLE CONSIDERATION. "SELLING"  SHALL  NOT  INCLUDE  THE  SHARING  OF
 PERSONAL  DATA  FOR  MONETARY OR OTHER VALUABLE CONSIDERATION TO ANOTHER
 PERSON AS AN ASSET THAT IS PART OF A MERGER, ACQUISITION, BANKRUPTCY, OR
 OTHER TRANSACTION IN WHICH THAT PERSON ASSUMES CONTROL OF ALL OR PART OF
 THE OPERATOR'S ASSETS.
   8. "THIRD PARTY" SHALL MEAN ANY PERSON WHO IS NOT ANY OF  THE  FOLLOW-
 ING:
   (A)  THE  OPERATOR  WITH WHOM THE USER INTENTIONALLY INTERACTS AND WHO
 COLLECTS PERSONAL DATA FROM THE USER  AS  PART  OF  THE  USER'S  CURRENT
 INTERACTION WITH THE OPERATOR;
   (B) THE USER WHOSE PERSONAL DATA THE OPERATOR PROCESSES; OR
   (C)  THE  PARENT  OR LEGAL GUARDIAN OF A USER UNDER THIRTEEN YEARS OLD
 WHOSE PERSONAL DATA THE OPERATOR PROCESSES.
   § 899-FF. PRIVACY PROTECTION BY DEFAULT. 1. EXCEPT AS PROVIDED FOR  IN
 SUBDIVISION SIX OF THIS SECTION AND SECTION EIGHT HUNDRED NINETY-NINE-JJ
 S. 7695                             3
 
 OF  THIS  ARTICLE, AN OPERATOR SHALL NOT PROCESS, OR ALLOW A THIRD PARTY
 TO PROCESS, THE PERSONAL DATA OF A COVERED USER  COLLECTED  THROUGH  THE
 USE  OF  A  WEBSITE, ONLINE SERVICE, ONLINE APPLICATION, MOBILE APPLICA-
 TION, OR CONNECTED DEVICE UNLESS AND TO THE EXTENT:
   (A)  THE COVERED USER IS TWELVE YEARS OF AGE OR YOUNGER AND PROCESSING
 IS PERMITTED UNDER 15 U.S.C. § 6502 AND ITS IMPLEMENTING REGULATIONS; OR
   (B) THE COVERED USER IS THIRTEEN YEARS OF AGE OR OLDER AND  PROCESSING
 IS  STRICTLY  NECESSARY  FOR AN ACTIVITY SET FORTH IN SUBDIVISION TWO OF
 THIS SECTION, OR INFORMED CONSENT HAS BEEN  OBTAINED  AS  SET  FORTH  IN
 SUBDIVISION THREE OF THIS SECTION.
   2.  FOR  THE  PURPOSES  OF  PARAGRAPH  (B)  OF SUBDIVISION ONE OF THIS
 SECTION, THE PROCESSING OF PERSONAL DATA OF A COVERED USER IS  PERMISSI-
 BLE WHERE IT IS STRICTLY NECESSARY FOR THE FOLLOWING ACTIVITIES:
   (A)  PROVIDING  OR MAINTAINING A SPECIFIC PRODUCT OR SERVICE REQUESTED
 BY THE COVERED USER;
   (B)  CONDUCTING  THE  OPERATOR'S  INTERNAL  BUSINESS  OPERATIONS.  FOR
 PURPOSES  OF THIS PARAGRAPH, SUCH INTERNAL BUSINESS OPERATIONS SHALL NOT
 INCLUDE ANY ACTIVITIES RELATED TO MARKETING, ADVERTISING,  OR  PROVIDING
 PRODUCTS OR SERVICES TO THIRD PARTIES, OR PROMPTING COVERED USERS TO USE
 THE  WEBSITE, ONLINE SERVICE, ONLINE APPLICATION, MOBILE APPLICATION, OR
 CONNECTED DEVICE WHEN IT IS NOT IN USE;
   (C) IDENTIFYING AND REPAIRING TECHNICAL ERRORS THAT IMPAIR EXISTING OR
 INTENDED FUNCTIONALITY;
   (D) PROTECTING AGAINST MALICIOUS, FRAUDULENT, OR ILLEGAL ACTIVITY;
   (E) INVESTIGATING, ESTABLISHING, EXERCISING, PREPARING FOR, OR DEFEND-
 ING LEGAL CLAIMS;
   (F) COMPLYING WITH FEDERAL, STATE, OR  LOCAL  LAWS,  RULES,  OR  REGU-
 LATIONS;
   (G)  COMPLYING WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTI-
 GATION, SUBPOENA, OR SUMMONS BY FEDERAL, STATE, LOCAL, OR OTHER  GOVERN-
 MENTAL AUTHORITIES;
   (H)  DETECTING,  RESPONDING  TO,  OR  PREVENTING SECURITY INCIDENTS OR
 THREATS; OR
   (I) PROTECTING THE VITAL INTERESTS OF A NATURAL PERSON.
   3. (A) FOR THE PURPOSES OF PARAGRAPH (B) OF SUBDIVISION  ONE  OF  THIS
 SECTION,  TO PROCESS PERSONAL DATA OF A COVERED USER WHERE SUCH PROCESS-
 ING IS NOT STRICTLY NECESSARY UNDER SUBDIVISION  TWO  OF  THIS  SECTION,
 INFORMED CONSENT MUST BE OBTAINED FROM THE COVERED USER EITHER THROUGH A
 DEVICE COMMUNICATION OR SIGNAL PURSUANT TO THE PROVISIONS OF SUBDIVISION
 TWO OF SECTION EIGHT HUNDRED NINETY-NINE-II OF THIS ARTICLE OR THROUGH A
 REQUEST. REQUESTS FOR SUCH INFORMED CONSENT SHALL:
   (I)  BE MADE SEPARATELY FROM ANY OTHER TRANSACTION OR PART OF A TRANS-
 ACTION;
   (II) BE MADE IN THE ABSENCE OF ANY MECHANISM THAT HAS THE  PURPOSE  OR
 SUBSTANTIAL  EFFECT  OF  OBSCURING,  SUBVERTING,  OR IMPAIRING A COVERED
 USER'S DECISION-MAKING REGARDING AUTHORIZATION FOR THE PROCESSING;
   (III) IF REQUESTING INFORMED CONSENT FOR MULTIPLE TYPES OF PROCESSING,
 ALLOW THE COVERED USER TO PROVIDE OR  WITHHOLD  CONSENT  SEPARATELY  FOR
 EACH TYPE OF PROCESSING;
   (IV)  CLEARLY AND CONSPICUOUSLY STATE THAT THE PROCESSING IS OPTIONAL,
 AND THAT THE COVERED USER MAY DECLINE WITHOUT PREVENTING  CONTINUED  USE
 OF  THE WEBSITE, ONLINE SERVICE, ONLINE APPLICATION, MOBILE APPLICATION,
 OR CONNECTED DEVICE; AND
   (V) CLEARLY PRESENT AN OPTION TO REFUSE TO PROVIDE CONSENT AS THE MOST
 PROMINENT OPTION.
 S. 7695                             4

   (B) SUCH INFORMED CONSENT, ONCE GIVEN, SHALL BE  FREELY  REVOCABLE  AT
 ANY TIME, AND SHALL BE AT LEAST AS EASY TO REVOKE AS IT WAS TO PROVIDE.
   (C)  IF A COVERED USER DECLINES TO PROVIDE OR REVOKES INFORMED CONSENT
 FOR PROCESSING, ANOTHER REQUEST MAY NOT BE MADE FOR SUCH PROCESSING  FOR
 THE FOLLOWING CALENDAR YEAR.
   (D)  IF  A  COVERED  USER'S  DEVICE  COMMUNICATES  OR SIGNALS THAT THE
 COVERED USER DECLINES TO PROVIDE INFORMED CONSENT FOR PROCESSING  PURSU-
 ANT  TO THE PROVISIONS OF SUBDIVISION TWO OF SECTION EIGHT HUNDRED NINE-
 TY-NINE-II OF THIS ARTICLE,  AN  OPERATOR  SHALL  NOT  REQUEST  INFORMED
 CONSENT FOR SUCH PROCESSING.
   4. EXCEPT WHERE PROCESSING IS STRICTLY NECESSARY TO PROVIDE A PRODUCT,
 SERVICE,  OR  FEATURE,  AN OPERATOR MAY NOT WITHHOLD, DEGRADE, LOWER THE
 QUALITY, OR INCREASE THE PRICE OF ANY PRODUCT, SERVICE, OR FEATURE TO  A
 COVERED  USER  DUE  TO  THE  OPERATOR  NOT OBTAINING VERIFIABLE PARENTAL
 CONSENT UNDER 15 U.S.C. §  6502  AND  ITS  IMPLEMENTING  REGULATIONS  OR
 INFORMED CONSENT UNDER SUBDIVISION THREE OF THIS SECTION.
   5.  EXCEPT  AS PROVIDED FOR IN SECTION EIGHT HUNDRED NINETY-NINE-JJ OF
 THIS ARTICLE, AN OPERATOR SHALL NOT PURCHASE OR SELL, OR ALLOW  A  THIRD
 PARTY TO PURCHASE OR SELL, THE PERSONAL DATA OF A COVERED USER.
   6.  WITHIN FOURTEEN DAYS OF DETERMINING THAT A USER IS A COVERED USER,
 AN OPERATOR SHALL:
   (A) DISPOSE OF, DESTROY, OR DELETE ALL PERSONAL DATA OF  SUCH  COVERED
 USER  THAT IT MAINTAINS, UNLESS PROCESSING SUCH PERSONAL DATA IS PERMIT-
 TED UNDER 15 U.S.C. § 6502 AND ITS IMPLEMENTING REGULATIONS, IS STRICTLY
 NECESSARY FOR AN ACTIVITY LISTED IN SUBDIVISION TWO OF THIS SECTION,  OR
 INFORMED  CONSENT  IS OBTAINED AS SET FORTH IN SUBDIVISION THREE OF THIS
 SECTION; AND
   (B) NOTIFY ANY THIRD PARTIES TO WHOM IT DISCLOSED THE  PERSONAL  DATA,
 AND  ANY THIRD PARTIES IT ALLOWED TO PROCESS THE PERSONAL DATA, THAT THE
 USER IS A COVERED USER.
   § 899-GG. THIRD PARTIES. 1. EXCEPT AS PROVIDED FOR  IN  SECTION  EIGHT
 HUNDRED  NINETY-NINE-JJ  OF THIS ARTICLE, NO OPERATOR SHALL DISCLOSE THE
 PERSONAL DATA OF A COVERED USER TO A THIRD PARTY, OR ALLOW THE  PROCESS-
 ING  OF  THE PERSONAL DATA OF A COVERED USER BY A THIRD PARTY, WITHOUT A
 WRITTEN, BINDING AGREEMENT GOVERNING SUCH DISCLOSURE OR PROCESSING. SUCH
 AGREEMENT SHALL CLEARLY  SET  FORTH  INSTRUCTIONS  FOR  THE  NATURE  AND
 PURPOSE   OF   THE   THIRD-PARTY'S  PROCESSING  OF  THE  PERSONAL  DATA,
 INSTRUCTIONS FOR USING OR FURTHER DISCLOSING THE PERSONAL DATA, AND  THE
 RIGHTS AND OBLIGATIONS OF BOTH PARTIES.
   2.  EXCEPT  AS PROVIDED FOR IN SECTION EIGHT HUNDRED NINETY-NINE-JJ OF
 THIS ARTICLE, PRIOR TO DISCLOSING PERSONAL DATA TO A  THIRD  PARTY,  THE
 OPERATOR  SHALL INFORM THE THIRD PARTY IF SUCH DATA IS THE PERSONAL DATA
 OF A COVERED USER.
   3. AN AGREEMENT PURSUANT TO SUBDIVISION  ONE  OF  THIS  SECTION  SHALL
 REQUIRE THAT THE THIRD PARTY:
   (A)  PROCESS  THE  PERSONAL DATA OF COVERED USERS ONLY WHEN AND TO THE
 EXTENT STRICTLY NECESSARY FOR AN ACTIVITY LISTED PURSUANT TO SUBDIVISION
 TWO OF SECTION EIGHT HUNDRED NINETY-NINE-FF OF THIS  ARTICLE,  OR  WHERE
 INFORMED  CONSENT  WAS OBTAINED PURSUANT TO SUBDIVISION THREE OF SECTION
 EIGHT HUNDRED NINETY-NINE-FF OF THIS ARTICLE;
   (B) DELETE OR RETURN TO THE OPERATOR  ALL  PERSONAL  DATA  OF  COVERED
 USERS  AT  THE END OF ITS PROVISION OF SERVICES, UNLESS RETENTION OF THE
 PERSONAL DATA IS REQUIRED BY LAW;
   (C) UPON REASONABLE REQUEST OF THE OPERATOR,  MAKE  AVAILABLE  TO  THE
 OPERATOR  ALL DATA IN ITS POSSESSION NECESSARY TO DEMONSTRATE THE THIRD-
 PARTY'S COMPLIANCE WITH THE OBLIGATIONS IN THIS SECTION;
 S. 7695                             5
 
   (D) ALLOW, AND COOPERATE WITH, REASONABLE ASSESSMENTS BY THE  OPERATOR
 OR THE OPERATOR'S DESIGNATED ASSESSOR FOR PURPOSES OF EVALUATING COMPLI-
 ANCE  WITH  THE  OBLIGATIONS  OF  THIS ARTICLE. ALTERNATIVELY, THE THIRD
 PARTY MAY ARRANGE FOR A QUALIFIED AND INDEPENDENT ASSESSOR TO CONDUCT AN
 ASSESSMENT  OF  THE  THIRD-PARTY'S  POLICIES AND TECHNICAL AND ORGANIZA-
 TIONAL MEASURES IN SUPPORT OF THE OBLIGATIONS UNDER THIS  ARTICLE  USING
 AN APPROPRIATE AND ACCEPTED CONTROL STANDARD OR FRAMEWORK AND ASSESSMENT
 PROCEDURE  FOR  SUCH ASSESSMENTS. THE THIRD PARTY SHALL PROVIDE A REPORT
 OF SUCH ASSESSMENT TO THE OPERATOR UPON REQUEST; AND
   (E) NOTIFY THE OPERATOR A REASONABLE TIME IN ADVANCE BEFORE DISCLOSING
 OR TRANSFERRING THE PERSONAL DATA OF COVERED USERS TO ANY FURTHER  THIRD
 PARTIES, WHICH MAY BE IN THE FORM OF A REGULARLY UPDATED LIST OF FURTHER
 THIRD PARTIES THAT MAY ACCESS PERSONAL DATA OF COVERED USERS.
   § 899-HH. ONGOING SAFEGUARDS. UPON LEARNING THAT A USER IS NO LONGER A
 COVERED  USER,  AN  OPERATOR  MAY  NOT PROCESS THE PERSONAL DATA OF SUCH
 PERSON IN A MANNER NOT PREVIOUSLY PERMITTED UNLESS AND UNTIL IT RECEIVES
 INFORMED CONSENT PURSUANT TO SUBDIVISION THREE OF SECTION EIGHT  HUNDRED
 NINETY-NINE-FF OF THIS ARTICLE.
   §  899-II.  RESPECTING USER-PROVIDED AGE FLAGS. 1. FOR THE PURPOSES OF
 THIS ARTICLE, AN OPERATOR SHALL TREAT A USER AS A COVERED  USER  IF  THE
 USER'S  DEVICE  COMMUNICATES  OR  SIGNALS  THAT  THE USER IS OR SHALL BE
 TREATED AS A MINOR, INCLUDING  THROUGH  A  BROWSER  PLUG-IN  OR  PRIVACY
 SETTING, DEVICE SETTING, OR OTHER MECHANISM.
   2.  FOR  THE  PURPOSES  OF  SUBDIVISION THREE OF SECTION EIGHT HUNDRED
 NINETY-NINE-FF OF THIS ARTICLE, AN OPERATOR SHALL ADHERE  TO  ANY  CLEAR
 AND  UNAMBIGUOUS COMMUNICATIONS OR SIGNALS FROM A COVERED USER'S DEVICE,
 INCLUDING THROUGH A BROWSER PLUG-IN OR PRIVACY SETTING, DEVICE  SETTING,
 OR OTHER MECHANISM, CONCERNING PROCESSING THAT THE COVERED USER CONSENTS
 TO OR DECLINES TO CONSENT TO. AN OPERATOR SHALL NOT ADHERE TO UNCLEAR OR
 AMBIGUOUS  COMMUNICATIONS  OR  SIGNALS FROM A COVERED USER'S DEVICE, AND
 SHALL INSTEAD REQUEST INFORMED CONSENT PURSUANT  TO  THE  PROVISIONS  OF
 PARAGRAPH A OF SUBDIVISION THREE OF SECTION EIGHT HUNDRED NINETY-NINE-FF
 OF THIS ARTICLE.
   §  899-JJ.  PROTECTIONS  FOR  THIRD-PARTY  OPERATORS.  SECTIONS  EIGHT
 HUNDRED NINETY-NINE-FF AND EIGHT HUNDRED NINETY-NINE-GG OF THIS  ARTICLE
 SHALL NOT APPLY TO AN OPERATOR PROCESSING THE PERSONAL DATA OF A COVERED
 USER  OF  ANOTHER  WEBSITE,  ONLINE  SERVICE, ONLINE APPLICATION, MOBILE
 APPLICATION, OR CONNECTED DEVICE, OR PORTION THEREOF, WHERE THE OPERATOR
 RECEIVED  REASONABLE  WRITTEN  REPRESENTATIONS  THAT  THE  COVERED  USER
 PROVIDED INFORMED CONSENT FOR SUCH PROCESSING, OR:
   1.  THE  OPERATOR DOES NOT HAVE ACTUAL KNOWLEDGE THAT THE COVERED USER
 IS A MINOR; AND
   2. THE OPERATOR DOES NOT HAVE ACTUAL KNOWLEDGE THAT THE OTHER WEBSITE,
 ONLINE SERVICE, ONLINE APPLICATION,  MOBILE  APPLICATION,  OR  CONNECTED
 DEVICE, OR PORTION THEREOF, IS PRIMARILY DIRECTED TO MINORS.
   §  899-KK.  RULEMAKING  AUTHORITY. THE ATTORNEY GENERAL MAY PROMULGATE
 SUCH RULES AND REGULATIONS AS ARE NECESSARY TO  EFFECTUATE  AND  ENFORCE
 THE PROVISIONS OF THIS ARTICLE.
   § 899-LL. SCOPE. 1. THIS ARTICLE SHALL APPLY TO CONDUCT THAT OCCURS IN
 WHOLE OR IN PART IN THE STATE OF NEW YORK. FOR PURPOSES OF THIS ARTICLE,
 COMMERCIAL  CONDUCT  TAKES PLACE WHOLLY OUTSIDE OF THE STATE OF NEW YORK
 IF THE BUSINESS COLLECTED SUCH INFORMATION WHILE THE  COVERED  USER  WAS
 OUTSIDE  OF  THE  STATE  OF  NEW YORK, NO PART OF THE USE OF THE COVERED
 USER'S PERSONAL DATA OCCURRED IN THE STATE OF NEW YORK, AND NO  PERSONAL
 DATA  COLLECTED  WHILE  THE COVERED USER WAS IN THE STATE OF NEW YORK IS
 USED.
 S. 7695                             6
 
   2. NOTHING IN THIS ARTICLE SHALL BE CONSTRUED TO PROHIBIT AN  OPERATOR
 FROM  STORING A COVERED USER'S PERSONAL DATA THAT WAS COLLECTED PURSUANT
 TO SECTION EIGHT  HUNDRED  NINETY-NINE-FF  OF  THIS  ARTICLE  WHEN  SUCH
 COVERED USER IS IN THE STATE.
   3.  NOTHING IN THIS ARTICLE SHALL BE CONSTRUED TO IMPOSE LIABILITY FOR
 COMMERCIAL ACTIVITIES OR ACTIONS BY OPERATORS SUBJECT TO 15 U.S.C.  6501
 THAT IS INCONSISTENT WITH THE TREATMENT OF SUCH  ACTIVITIES  OR  ACTIONS
 UNDER 15 U.S.C. 6502.
   §  899-MM.  REMEDIES.  1. WHENEVER IT APPEARS TO THE ATTORNEY GENERAL,
 EITHER UPON COMPLAINT OR OTHERWISE, THAT ANY PERSON, WITHIN  OR  OUTSIDE
 THE  STATE,  HAS  ENGAGED IN OR IS ABOUT TO ENGAGE IN ANY OF THE ACTS OR
 PRACTICES STATED TO BE UNLAWFUL IN THIS ARTICLE,  THE  ATTORNEY  GENERAL
 MAY  BRING  AN ACTION OR SPECIAL PROCEEDING IN THE NAME AND ON BEHALF OF
 THE PEOPLE OF THE STATE OF NEW YORK TO  ENJOIN  ANY  VIOLATION  OF  THIS
 ARTICLE,  TO  OBTAIN  RESTITUTION  OF  ANY  MONEYS  OR PROPERTY OBTAINED
 DIRECTLY OR INDIRECTLY BY ANY SUCH VIOLATION, TO OBTAIN DISGORGEMENT  OF
 ANY  PROFITS  OR  GAINS  OBTAINED  DIRECTLY  OR  INDIRECTLY  BY ANY SUCH
 VIOLATION, INCLUDING BUT NOT LIMITED TO THE  DESTRUCTION  OF  UNLAWFULLY
 OBTAINED  DATA  AND  ALGORITHMS  TRAINED ON SUCH DATA, TO OBTAIN DAMAGES
 CAUSED DIRECTLY OR INDIRECTLY BY ANY SUCH  VIOLATION,  TO  OBTAIN  CIVIL
 PENALTIES  OF  UP  TO FIVE THOUSAND DOLLARS PER VIOLATION, AND TO OBTAIN
 ANY SUCH OTHER AND FURTHER RELIEF AS THE COURT MAY DEEM PROPER,  INCLUD-
 ING PRELIMINARY RELIEF.
   2.  ANY  COVERED  USER  WHO HAS BEEN INJURED BY A VIOLATION OF SECTION
 EIGHT HUNDRED NINETY-NINE-FF  OF THIS ARTICLE, OR THE  PARENT  OR  LEGAL
 GUARDIAN  OF  A  COVERED  MINOR  WHO  HAS BEEN INJURED BY A VIOLATION OF
 SECTION EIGHT HUNDRED NINETY-NINE-FF  OF  THIS  ARTICLE,  MAY  BRING  AN
 ACTION TO OBTAIN:
   (A)  DAMAGES OF UP TO FIVE THOUSAND DOLLARS PER COVERED USER PER INCI-
 DENT OR ACTUAL DAMAGES, WHICHEVER IS GREATER;
   (B) INJUNCTIVE OR DECLARATORY RELIEF; AND/OR
   (C) ANY OTHER RELIEF THE COURT DEEMS PROPER.
   3. ACTIONS PURSUANT TO THIS SECTION MAY BE  BROUGHT  ON  A  CLASS-WIDE
 BASIS.
   4.  THE  COURT  MAY  AWARD  REASONABLE ATTORNEYS' FEES TO A PREVAILING
 PLAINTIFF.
   5. PRIOR TO BRINGING ANY ACTION FOR VIOLATIONS OF THIS ARTICLE  PURSU-
 ANT TO SUBDIVISION TWO OF THIS SECTION, A COVERED USER SHALL PROVIDE THE
 OPERATOR THIRTY DAYS' WRITTEN NOTICE IDENTIFYING THE SPECIFIC PROVISIONS
 OF  THIS  ARTICLE  THE  COVERED  USER  ALLEGES  HAVE  BEEN  OR ARE BEING
 VIOLATED. IN THE EVENT A CURE IS POSSIBLE, IF WITHIN THE THIRTY DAYS THE
 OPERATOR ACTUALLY CURES THE NOTICED VIOLATION AND PROVIDES  THE  COVERED
 USER  AN  EXPRESS  WRITTEN STATEMENT THAT THE VIOLATIONS HAVE BEEN CURED
 AND THAT NO FURTHER VIOLATIONS SHALL OCCUR,  NO  ACTION  FOR  INDIVIDUAL
 STATUTORY  DAMAGES  OR  CLASS-WIDE  STATUTORY  DAMAGES  MAY BE INITIATED
 AGAINST THE OPERATOR. NO NOTICE SHALL BE REQUIRED PRIOR TO AN INDIVIDUAL
 CONSUMER INITIATING  AN  ACTION  SOLELY  FOR  ACTUAL  PECUNIARY  DAMAGES
 SUFFERED AS A RESULT OF THE ALLEGED VIOLATIONS OF THIS TITLE. IF A BUSI-
 NESS  CONTINUES TO VIOLATE THIS ARTICLE IN BREACH OF THE EXPRESS WRITTEN
 STATEMENT PROVIDED TO THE COVERED USER UNDER THIS SECTION,  THE  COVERED
 USER  MAY INITIATE AN ACTION AGAINST THE BUSINESS TO ENFORCE THE WRITTEN
 STATEMENT AND MAY PURSUE  STATUTORY  DAMAGES  FOR  EACH  BREACH  OF  THE
 EXPRESS WRITTEN STATEMENT, AS WELL AS ANY OTHER VIOLATION OF THE ARTICLE
 THAT POSTDATES SUCH WRITTEN STATEMENT.
   §  2.  Severability.  If any clause, sentence, paragraph, subdivision,
 section or part of this act shall be adjudged by any court of  competent
 S. 7695                             7
 
 jurisdiction  to  be invalid, such judgment shall not affect, impair, or
 invalidate the remainder thereof, but shall be confined in its operation
 to the clause, sentence, paragraph, subdivision, section or part thereof
 directly  involved  in the controversy in which such judgment shall have
 been rendered. It is hereby declared to be the intent of the legislature
 that this act would have been enacted even if  such  invalid  provisions
 had not been included herein.
   §  3. This act shall take effect one year after it shall have become a
 law. Effective immediately, the addition, amendment and/or repeal of any
 rule or regulation necessary for the implementation of this act  on  its
 effective date are authorized to be made and completed on or before such
 effective date.