Selling company data to AI companies in New York

This guide covers the New York rules that apply when a company licenses records to an AI buyer. The federal rules in our US guide still apply, and so do other states' laws for their residents. If your archive includes Californians, read our California guide too.

Does New York have a comprehensive privacy law?

New York does not have a comprehensive privacy law. It is not among the 21 states that JD Supra counted as having enacted one by spring 2026, so there is no New York statute that gives consumers a general right to opt out of a sale of their personal data.

The legislature has tried to regulate health data. The New York Health Information Privacy Act, S929, passed in January 2025 and was vetoed by Governor Hochul in December 2025, according to Morrison Foerster. A revised bill, S9269, was introduced in the 2026 session.

Morrison Foerster's March 2026 summary says S9269 would cover health information linkable to a person, including health inferences drawn by algorithms or machine learning, with Attorney General enforcement, civil penalties of up to $15,000 per violation and an effective date six months after enactment. Check its status before you license any health-related data.

What does the SHIELD Act require of a data seller?

The SHIELD Act requires a data seller that owns or licenses computerized private information of a New York resident to develop, implement and maintain reasonable safeguards. General Business Law section 899-bb says those safeguards must protect the security, confidentiality and integrity of the information, including its disposal.

Small businesses get a proportionate standard. Section 899-bb defines a small business as one with fewer than 50 employees, less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets, and lets it use safeguards appropriate to its size and complexity. Businesses that comply with GLBA or HIPAA security rules are deemed compliant.

The Attorney General enforces section 899-bb under General Business Law section 349, and the section creates no private right of action. For a seller, the duty bites during preparation: exports, data rooms and sample files are where private information is most exposed. Our data room entry covers the basics.

Do New York's employee monitoring rules affect licensing staff email?

New York's employee monitoring rules affect licensing staff email because they shape what employees were told about their messages. Civil Rights Law section 52-c requires an employer with a place of business in New York that monitors employee telephone, email or internet use to give prior written notice on hiring, get an acknowledgment and post the notice where staff can see it.

The Attorney General enforces section 52-c, with civil penalties of $500 for a first offense, $1,000 for a second and $3,000 for later offenses. A monitoring notice describes monitoring. It may not tell staff that their messages could be licensed to a third party, so check its wording alongside your employee privacy notice before you include workplace communications.

Does New York City restrict selling biometric data?

New York City restricts selling biometric data through Local Law 3 of 2021, which took effect in July 2021. It makes it unlawful to sell, lease, trade or otherwise profit from biometric identifier information, including sharing it in exchange for anything of value.

The law applies to commercial establishments such as retail stores, food and drink establishments and entertainment venues. Biometric identifiers include iris or retina scans, fingerprints, voiceprints and face or hand geometry. People can sue for $500 per negligent violation and $5,000 per intentional or reckless violation of the sale ban, with no prior notice required.

Retailers, restaurants and venues with camera footage analyzed by identification software should treat that footage as out of scope. Photos and videos that are not analyzed by identification software and are not shared or sold are outside the signage rule, but a sale is a different question.

New York City regulates AI hiring tools through Local Law 144 of 2021, which governs automated employment decision tools. The Department of Consumer and Worker Protection says employers may use such a tool only after a bias audit within the past year, with a public summary of results and notice to candidates 10 business days before use. Enforcement began on July 5, 2023.

The law binds employers and employment agencies that use the tools, not sellers of data. It matters if you are a recruitment agency licensing hiring records, because buyers building hiring products will ask how your data supports a bias audit.

Is New York a one-party consent state for call recordings?

New York is a one-party consent state for call recordings. Penal Law section 250.00 defines unlawful mechanical overhearing as recording a conversation without the consent of at least one party, by a person not present.

Many New York companies record calls with people in other states. The Reporters Committee for Freedom of the Press lists about 11 states, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, that require all parties' consent. Check where callers were before licensing a recording archive.

What AI laws did New York pass in 2025?

New York passed four AI-related laws in December 2025, according to Troutman Pepper Locke: the RAISE Act on frontier AI models, a synthetic performer disclosure law for advertising, a digital replica amendment to the right of publicity, and an amendment to the LOADinG Act on government use of automated decision tools.

None of the four restricts selling training data directly. The RAISE Act applies to developers of frontier models, which may include some buyers, and could shape the safety and documentation questions they ask sellers.

Which buyers accept New York sellers?

Buyers that accept US sellers accept New York companies. micro1 says demand is strongest in the US, Endless Data prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction. None publishes New York-specific terms.

What are New York's rules at a glance?

What should a New York company do before licensing?

A New York company should work out which state's law applies to each person in its records, then tighten security around the export. These steps follow the New York laws cited above.

1. 1

   Map residents by state

   Identify Californians and residents of other states with privacy laws, since their own laws apply to their data.

2. 2

   Read staff notices

   Compare your Civil Rights Law 52-c monitoring notice and employee privacy notice with the proposed use.

3. 3

   Remove biometric data

   Exclude analyzed camera footage, voiceprints and other biometric identifiers, especially in New York City.

4. 4

   Secure the export

   Apply SHIELD Act safeguards to extracts, data rooms and samples, and delete working copies when done.

5. 5

   Watch the health bill

   Check whether S9269 has passed before licensing any data that could reveal health status.

For a view of likely buyers, a realistic range and the rights issues to clear first, request a free data valuation.