Jurisdiction

New York privacy and AI laws

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

NY RAISE ActFrontier AI developers must publish transparency reports when they deploy models and report critical safety incidents to a new DFS oversight office within 72 hours, or within 24 hours to authorities where there is imminent risk of death or injury. Large frontier developers must also publish and annually update a Frontier AI Framework, submit catastrophic-risk assessments, file disclosure statements with DFS every two years, and pay a share of the office's costs. The March 2026 chapter amendment realigned the law closely with California SB 53.Next: Jan 1, 2027 RAISE Act takes effect · in 2 months

Enacted

NY SAFE for Kids ActSocial media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.Next: Jan 25, 2027 Act and rules take effect · in 3 months

In force

NY Algorithmic Pricing Disclosure ActAny business that sets a price using personalized algorithmic pricing must show the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' next to the price. Insurers, GLBA financial institutions and certain subscription prices are exempt.In effect since Nov 10, 2025

In force

NY Child Data Protection ActOnline operators may not collect, use, share or sell personal data of users under 18 unless it is strictly necessary for the service or they obtain informed consent. It covers sites and apps directed to minors or with actual knowledge that a user is a minor.In effect since Jun 20, 2025

In force

NYC Local Law 144 (AEDT)Employers and employment agencies may not use an automated employment decision tool (AEDT) to screen candidates or employees for hiring or promotion unless the tool has had an independent bias audit within the past year. They must publish a summary of the audit results and give candidates at least 10 business days' notice that an AEDT will be used.In effect since Jul 5, 2023

Amended

NYDFS Cybersecurity Regulation (Part 500)DFS-licensed financial companies must keep a risk-based cybersecurity program, CISO, policies, access controls, MFA, encryption, an asset inventory, and incident response and business continuity plans. They must notify DFS within 72 hours of a cybersecurity event and within 24 hours of any extortion payment, and certify compliance or acknowledge non-compliance each April 15. The 2023 Second Amendment added governance duties, Class A company requirements and phased controls through November 1, 2025.In effect since Mar 1, 2017

Upcoming deadlines

Takes effectJan 1, 2027 · in 2 months

NY RAISE ActRAISE Act takes effectTransparency reports, frontier AI frameworks, incident reporting and DFS disclosure filings apply.New York

Takes effectJan 25, 2027 · in 3 months

NY SAFE for Kids ActAct and rules take effect180 days after State Register publication.New York

Past deadlines

MilestoneJul 29 · 3 months ago

NY SAFE for Kids ActRules published in State RegisterStarts the 180-day clock.New York

Transition endsJul 28 · 3 months ago

NY SAFE for Kids ActFinal SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.New York

ReportingApr 15 · 6 months ago

NYDFS Cybersecurity Regulation (Part 500)Annual compliance notificationAnnual certification or acknowledgment covering calendar year 2025 due.New York

MilestoneMar 27 · 7 months ago

NY RAISE ActChapter amendment S8828 signedChapter amendment (ch. 96) finalizes the RAISE Act text.New York

MilestoneDec 19, 2025 · 10 months ago

NY RAISE ActRAISE Act signedGovernor Hochul signs the RAISE Act with an agreed chapter amendment.New York

Takes effectNov 10, 2025 · 12 months ago

NY Algorithmic Pricing Disclosure ActDisclosure duty takes effectAlgorithmic pricing disclosures required.New York

ComplianceNov 1, 2025 · 12 months ago

NYDFS Cybersecurity Regulation (Part 500)Universal MFA and asset inventory500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.New York

Takes effectJun 20, 2025 · 16 months ago

NY Child Data Protection ActTakes effectEffective one year after becoming law.New York

MilestoneMay 9, 2025 · 18 months ago

NY Algorithmic Pricing Disclosure ActSigned as part of FY2026 budgetS3008C Part X signed as Chapter 58 of 2025.New York

ComplianceMay 1, 2025 · 18 months ago

NYDFS Cybersecurity Regulation (Part 500)Vulnerability scans, access privileges, malware controls, Class A monitoring500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.New York

ComplianceNov 1, 2024 · 24 months ago

NYDFS Cybersecurity Regulation (Part 500)Governance, encryption, IR/BCDR, exemptions500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.New York

MilestoneJun 20, 2024 · 2.4 years ago

NY SAFE for Kids ActSigned by GovernorChapter 120 of 2024.New York

MilestoneJun 20, 2024 · 2.4 years ago

NY Child Data Protection ActSigned by GovernorChapter 121 of 2024.New York

ComplianceApr 29, 2024 · 2.5 years ago

NYDFS Cybersecurity Regulation (Part 500)General 180-day transition endsMost new Second Amendment requirements apply, e.g. annual reporting to the board and risk assessment updates.New York

ReportingApr 15, 2024 · 2.5 years ago

NYDFS Cybersecurity Regulation (Part 500)Annual compliance notificationCertification of compliance or acknowledgment of non-compliance due (recurs every April 15).New York

ComplianceDec 1, 2023 · 2.9 years ago

NYDFS Cybersecurity Regulation (Part 500)Amended notification requirements (500.17)New 72-hour event notice, 24-hour extortion payment notice and certification changes apply (30 days).New York

Takes effectNov 1, 2023 · 3 years ago

NYDFS Cybersecurity Regulation (Part 500)Second Amendment effectiveSecond Amendment takes effect; 500.19(e)-(h), 500.20, 500.21, 500.22 and 500.24 apply immediately.New York

EnforcementJul 5, 2023 · 3.3 years ago

NYC Local Law 144 (AEDT)DCWP enforcement beginsBias audit, results publication and candidate notice requirements are enforced.New York City, New York

Takes effectMar 1, 2017 · 9.7 years ago

NYDFS Cybersecurity Regulation (Part 500)Part 500 effectiveOriginal cybersecurity regulation takes effect.New York