§ 204. Collection and disclosure of personal information. No state
agency shall collect personal information concerning a user through a
state agency website, or disclose personal information concerning a user
to any person, firm, partnership, corporation, limited liability company
or other entity, including internal staff who do not need the
information in the performance of their official duties pursuant to a
state agency purpose meeting the requirements of subdivision one of
section two hundred six of this article, unless such user has consented
to the collection or disclosure of such personal information. For the
purposes of this section, the voluntary disclosure of personal
information to a state agency by a user through a state agency website,
whether solicited or unsolicited, shall constitute consent to the
collection or disclosure of the information by the state agency for the
purposes for which the user disclosed it to the state agency, as
reasonably ascertainable from the nature and terms of the disclosure.