N.Y.
General Business Law Section 899-EE
Definitions
1.
“Covered user” shall mean a user of a website, online service, online application, mobile application, or connected device, or portion thereof, in the state of New York who is:(a)
actually known by the operator of such website, online service, online application, mobile application, or connected device to be a minor; or(b)
using a website, online service, online application, mobile application, or connected device primarily directed to minors.2.
“Minor” shall mean a natural person under the age of eighteen.3.
“Operator” shall mean any person who operates or provides a website on the internet, online service, online application, mobile application, or connected device, and who, alone or jointly with others, controls the purposes and means of processing personal data. A person that acts as both an operator and processor shall comply with the applicable obligations of an operator and the obligations of a processor, depending on its role with respect to each specific processing of personal data.4.
“Personal data” shall mean any data that identifies or could reasonably be linked, directly or indirectly, with a specific natural person or device.5.
“Process” or “processing” shall mean an operation or set of operations performed on personal data, including but not limited to the collection, use, access, sharing, sale, monetization, analysis, retention, creation, generation, derivation, recording, organization, structuring, storage, disclosure, transmission, disposal, licensing, destruction, deletion, modification, or deidentification of personal data.6.
“Primarily directed to minors” shall mean a website, online service, online application, mobile application, or connected device, or a portion thereof, that is targeted to minors. A website, online service, online application, mobile application, or connected device, or portion thereof, shall not be deemed directed primarily to minors solely because such website, online service, online application, mobile application, or connected device, or portion thereof refers or links to any other website, online service, online application, mobile application, or connected device directed to minors by using information location tools, including a directory, index, reference, pointer, or hypertext link. A website, online service, online application, mobile application, or connected device, or portion thereof, shall be deemed directed to minors when it has actual knowledge that it is collecting personal data of users directly from users of another website, online service, online application, mobile application, or connected device primarily directed to minors.7.
“Sell” shall mean to share personal data for monetary or other valuable consideration. “Selling” shall not include the sharing of personal data for monetary or other valuable consideration to another person as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which that person assumes control of all or part of the operator’s assets or the sharing of personal data with a processor.8.
“Processor” shall mean any person who processes data on behalf of the operator. A person that acts as both an operator and processor shall comply with the applicable obligations of an operator and the obligations of a processor, depending on its role with respect to each specific processing of personal data.9.
“Third-party operator” shall mean an operator who is not the operator:(a)
with whom the user intentionally and directly interacts; or(b)
that collects personal data from the direct and current interactions with the user. * NB Effective June 20, 2025
Source:
Section 899-EE — Definitions, https://www.nysenate.gov/legislation/laws/GBS/899-EE (updated Jun. 28, 2024; accessed Dec. 21, 2024).
