Does New York Have a Comprehensive Consumer Privacy Law in 2026?

No, New York does not have a comprehensive consumer privacy law in 2026. The New York Privacy Act — Senate Bill S3044 and its Assembly companion, A8158 — remains in committee, with the Senate bill's most recent recorded action listed as "In Senate Committee" as of January 7, 2026, according to the New York State Senate's own bill-tracking page.

Where the Bill Actually Stands

New York's flagship privacy proposal has been reintroduced repeatedly over the years, and 2026 hasn't changed that pattern:

• S3044 was introduced on January 23, 2025 and has carried through the two-year 2025-2026 legislative session without a floor vote in either chamber.
• The Assembly companion, A8158, shows the identical status — in committee, with its most recent action also dated January 7, 2026.
• Other bills target narrower pieces of the same problem, including a separate New York Data Protection Act (S8524) that would take effect two years after enactment if it ever passes, rather than moving as one broad consumer-rights package.

What New York Has Instead of a General Privacy Law

New York hasn't left residents with zero protection — it has built a patchwork instead of a single statute modeled on California, Virginia, or Colorado's laws:

• The SAFE for Kids Act is in force for minors. The Attorney General finalized implementing rules in late July 2026, requiring platforms to disable algorithmic feeds and overnight push notifications for users under 18 unless a parent gives verifiable consent, with the rules taking full effect January 25, 2027.
• Federal sectoral laws still apply regardless of state law. CAN-SPAM, COPPA, TCPA, GLBA, and HIPAA all reach New York residents the same way they reach residents of any other state, independent of whether New York passes a general privacy statute.
• New York's SHIELD Act governs data security, not advertising. It requires reasonable safeguards for private information but doesn't create the access, deletion, or opt-out rights a comprehensive privacy law would.

Why This Still Matters for Advertisers

A marketer running campaigns nationally shouldn't read "no New York law" as "no obligation in New York." Most advertisers of any scale already carry compliance obligations from the roughly 20 states that have passed comprehensive privacy laws, and those obligations typically extend to any consumer the business markets to — New York residents included — once a business crosses another state's applicability threshold. The absence of a New York-specific law mainly means New York residents don't get an independent, state-level right to access, delete, or opt out of data sales the way California or Virginia residents do, unless a different state's law happens to cover them anyway.

Bottom Line

Treat New York as uncovered by a dedicated comprehensive privacy law for now, but don't treat New York residents as unprotected — the SAFE for Kids Act already binds platforms serving minors, and most other obligations flow from federal law or from whichever other states' privacy laws already apply to your business. Recheck the New York Privacy Act's status each legislative session, since it's reintroduced every cycle and New York has passed major tech regulation in the meantime.

Source: New York State Senate bill-tracking pages for S3044 and A8158 (nysenate.gov); New York Attorney General's final SAFE for Kids Act implementing rules, July 2026.