S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   3367
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 27, 2017
                                ___________
 
 Introduced  by  M. of A. KAVANAGH, ORTIZ, PERRY, COLTON, TITUS, GUNTHER,
   LUPARDO,  JAFFEE,  O'DONNELL,  CUSICK,  ZEBROWSKI,  BENEDETTO,  GALEF,
   CAHILL,  HOOPER,  PRETLOW,  TITONE, ROSENTHAL, WEPRIN, QUART -- Multi-
   Sponsored by -- M. of A. ARROYO, DINOWITZ, GOTTFRIED, HEVESI,  HIKIND,
   PEOPLES-STOKES  -- read once and referred to the Committee on Consumer
   Affairs and Protection
 
 AN ACT to amend the general business law, in  relation  to  establishing
   the online consumer protection act
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Short title. This act shall be known and may  be  cited  as
 the "online consumer protection act".
   §  2.  Legislative  findings.  The  state  has  the authority to enact
 consumer regulations to protect the people of the state.  Recently,  the
 state  has enacted a series of laws to address problems arising from the
 ubiquity of the internet.  From  protecting  consumers  from  electronic
 breaches  of  security  to  enacting  laws  prohibiting  the practice of
 "phishing" -- an electronic form of identify theft -- the state  has  an
 obligation to enact sensible protections for the people.
   The  internet  age  has  changed, often for the better, the way people
 work, enjoy entertainment and interact with one another.  However,  with
 the  internet age new problems have arisen that must be addressed, chief
 among them, the loss of personal privacy. Recent examples, including one
 where search engine results were tracked to an individual,  have  illus-
 trated  that  a  person's  privacy can be breached easily and with grave
 consequences. There is a fundamental rift  between  tracking  technology
 and  consumers'  right  to  control  what data is collected and where it
 goes. Action must be taken in order to prevent more egregious violations
 of  privacy  occurring  including  price  discrimination,  exposure   of
 personal information to subpoenas and warrantless government access.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD02732-01-7
              

 A. 3367                             2
 
   This  act  establishes  provisions  to  allow consumers the ability to
 simply opt-out of being monitored on  the  internet.  Such  protections,
 akin  to the do not call registry, are a fair, sensible and common sense
 way to give consumers a clear choice with respect to being monitored.
   §  3. The general business law is amended by adding a new section 390-
 bb to read as follows:
   § 390-BB. ONLINE CONSUMER PROTECTION. 1.  FOR  THE  PURPOSES  OF  THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A) THE TERM "ONLINE PREFERENCE MARKETING" SHALL MEAN A TYPE OF ADVER-
 TISEMENT  DELIVERY  AND REPORTING WHEREBY DATA IS COLLECTED TO DETERMINE
 OR PREDICT CONSUMER CHARACTERISTICS OR PREFERENCE FOR USE IN  ADVERTISE-
 MENT DELIVERY ON THE INTERNET.
   (B)  THE  TERM  "PERSONALLY  IDENTIFIABLE INFORMATION" SHALL MEAN DATA
 THAT, BY ITSELF, CAN BE USED TO IDENTIFY, CONTACT OR  LOCATE  A  PERSON,
 INCLUDING  NAME,  ADDRESS, TELEPHONE NUMBER, SENSITIVE MEDICAL OR FINAN-
 CIAL DATA, SEXUAL BEHAVIOR, SEXUAL ORIENTATION, OR EMAIL ADDRESS.
   (C) THE TERM "PUBLISHER" SHALL MEAN ANY COMPANY, INDIVIDUAL  OR  OTHER
 GROUP THAT HAS A WEBSITE, WEBPAGE OR OTHER INTERNET PAGE.
   (D) THE TERM "CONSUMER" SHALL MEAN ANY NATURAL PERSON USING OR ACCESS-
 ING  A  WEBSITE,  WEBPAGE OR ONLINE SERVICE THAT INCLUDES THE DISPLAY OF
 ADVERTISEMENTS.
   (E) THE TERM "ADVERTISING NETWORK" SHALL MEAN ANY COMPANY,  INDIVIDUAL
 OR  OTHER  GROUP  THAT  IS  COLLECTING  ONLINE CONSUMER ACTIVITY FOR THE
 PURPOSES OF AD DELIVERY.
   2. NO PUBLISHER OF A WEBPAGE OR ADVERTISING NETWORK CONTRACTED WITH  A
 PUBLISHER  SHALL  COLLECT  PERSONALLY  IDENTIFIABLE  INFORMATION FOR THE
 PURPOSES OF ONLINE PREFERENCE MARKETING.   THIS  SUBDIVISION  SHALL  NOT
 APPLY  TO THE COLLECTION OF PERSONALLY IDENTIFIABLE INFORMATION PROVIDED
 TO A PUBLISHER OF A WEBPAGE OR ADVERTISING  NETWORK  CONTRACTED  WITH  A
 PUBLISHER BY THE CONSUMER WITH HIS OR HER CONSENT.
   3.  NO PUBLISHER OF A WEBPAGE OR ADVERTISING NETWORK CONTRACTED WITH A
 PUBLISHER SHALL COLLECT ANY OTHER INFORMATION FROM A  CONSUMER  THAT  IS
 NOT  DEFINED AS PERSONALLY IDENTIFIABLE INFORMATION PURSUANT TO SUBDIVI-
 SION ONE OF THIS SECTION FOR THE PURPOSES OF ONLINE PREFERENCE MARKETING
 UNLESS THE CONSUMER IS GIVEN AN OPPORTUNITY TO OPT-OUT  OF  THE  USE  OF
 SUCH INFORMATION FOR ONLINE MARKETING PURPOSES.
   4.  AN  ADVERTISING NETWORK SHALL POST CLEAR AND CONSPICUOUS NOTICE ON
 THE HOME PAGE OF ITS OWN WEBSITE ABOUT ITS PRIVACY POLICY AND  ITS  DATA
 COLLECTION  AND USE PRACTICES RELATED TO ITS ADVERTISING DELIVERY ACTIV-
 ITIES. IF A PUBLISHER HAS CONTRACTED WITH AN  ADVERTISING  NETWORK,  THE
 PUBLISHER  SHALL  POST  CLEAR AND CONSPICUOUS NOTICE ON ITS WEBSITE THAT
 DESCRIBES THE COLLECTION AND  USE  OF  INFORMATION  BY  THE  ADVERTISING
 NETWORK. IF THE ADVERTISING NETWORK ENGAGES IN ONLINE PREFERENCE MARKET-
 ING,  THE  PRIVACY  POLICIES  OF  BOTH  THE  ADVERTISING NETWORK AND THE
 PUBLISHER SHALL DESCRIBE THE ABILITY TO  OPT-OUT  OF  ONLINE  PREFERENCE
 MARKETING BY SUCH NETWORK.
   5. AN ADVERTISING NETWORK SHALL MAKE REASONABLE EFFORTS TO PROTECT THE
 DATA  IT  COLLECTS OR LOGS AS A RESULT OF AD DELIVERY AND REPORTING FROM
 LOSS, MISUSE, ALTERATION, DESTRUCTION OR IMPROPER ACCESS.
   6. THE ATTORNEY GENERAL MAY BRING  AN  ACTION  AGAINST  A  PERSON  WHO
 VIOLATES THE PROVISIONS OF THIS SECTION:
   (A) TO ENJOIN FURTHER VIOLATION OF THE PROVISIONS OF THIS SECTION; AND
   (B)  TO  RECOVER  UP TO TWO HUNDRED FIFTY DOLLARS FOR EACH INSTANCE IN
 WHICH IDENTIFYING INFORMATION IS COLLECTED FROM A PERSON IN VIOLATION OF
 THE PROVISIONS OF SUBDIVISION TWO OR THREE OF THIS SECTION.

 A. 3367                             3
 
   IN AN ACTION UNDER PARAGRAPH (B) OF  THIS  SUBDIVISION,  A  COURT  MAY
 INCREASE THE DAMAGES UP TO THREE TIMES THE DAMAGES ALLOWED BY SUCH PARA-
 GRAPH  WHERE  THE  DEFENDANT HAS BEEN FOUND TO HAVE ENGAGED IN A PATTERN
 AND PRACTICE OF VIOLATING THE PROVISIONS OF SUBDIVISION TWO OR THREE  OF
 THIS SECTION.
   7.  NOTHING  IN THIS SECTION SHALL IN ANY WAY LIMIT RIGHTS OR REMEDIES
 WHICH ARE OTHERWISE AVAILABLE UNDER LAW TO THE ATTORNEY GENERAL  OR  ANY
 OTHER  PERSON  AUTHORIZED  TO  BRING AN ACTION UNDER SUBDIVISION FIVE OF
 THIS SECTION.
   § 4. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.