New York State’s Algorithmic Pricing Disclosure Act Imposes New Disclosure Requirements on Businesses

Businesses Must Adapt to New Standards for How Personal Data Is Utilized

New York State has introduced the following legislation that targets the use of algorithms: the Algorithmic Pricing Disclosure Act and the Stop Addictive Feeds Exploitation for Kids Act. These establish new regulations that businesses must consider, and may need to comply with, while doing business in New York.

New York’s Algorithmic Pricing Disclosure Act

Companies that use computer programs or artificial intelligence (AI) to tailor their pricing of goods or services to particular consumers, may need to comply with a new law that went into effect on November 10, 2025. New York’s Algorithmic Pricing Disclosure Act (the “Act”) requires companies to disclose the use of personalized algorithmic pricing for goods and services¹ that leverage the personal data of a consumer.²

The Act applies to New York-based entities and entities that do business in New York that utilize personalized data of consumers who are located within New York to set pricing of goods or services.³ Under the Act, a consumer is defined as a “natural person who is seeking or solicited to purchase, lease or receive a good or service for personal, family, or household use.”⁴ Personal data is defined as “any data that identifies or could reasonably be linked, directly or indirectly, with a specific consumer or device.”⁵ For example, a company may be using personalized algorithmic pricing if the same goods are more expensive when viewed online while the consumer is inside the store, versus online at home, because the company may be using the consumer’s location to set dynamic pricing.⁶

The Act does not apply to:

• Entities that are subject to insurance laws or regulations;
• Financial institutions that are subject to Title V of the Gramm Leach Bliley Act;
• Financial institutions as defined by the Financial Services Law; and
• Prices offered to consumers with an existing subscription-based contract or agreement for goods or services that is less than the current price for that same subscription-based contract or agreement.⁷

Entities that use personalized algorithmic pricing must make a clear and conspicuous disclosure⁸ that reads: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.”⁹ This disclosure must occur “near and contemporaneous with every advertisement, display, image, offer or announcement of a price” that was set using personalized algorithmic pricing.¹⁰ Other than entities that are excepted from the disclosure requirements, the statute does not provide for an opt-out mechanism.

The attorney general issued a related consumer alert encouraging New Yorkers to report entities that fail to adhere to the Act’s disclosure requirements.¹¹ The attorney general can then use such reports to enforce the new law by demanding that the company cure the alleged violation within a set time period.¹² If the company fails to comply timely, the attorney general can seek a court order requiring compliance and/or impose fines up to $1,000 per violation.¹³

New York’s Stop Addictive Feeds Exploitation (SAFE) for Kids Act

New York is regulating algorithm use in other ways. Instead of merely requiring disclosure, the Stop Addictive Feeds Exploitation for Kids Act (the “SAFE for Kids Act”) outright prohibits social media platforms from providing minors with an “addictive” social media feed generated by using minors’ data to personalize material that the minors see.¹⁴ According to the New York State Legislature, these “addictive feeds” cause minors to stay on social media platforms for long periods of time, increasing the incidence of anxiety and depression.¹⁵ In addition, the SAFE for Kids Act prohibits social media platforms from sending notifications to minors between midnight and 6:00 AM, absent parental consent.¹⁶

Before the SAFE for Kids Act takes effect, the Office of the Attorney General (the “OAG”) is charged with promulgating regulations to effectuate and enforce the SAFE for Kids Act.¹⁷ In the OAG’s proposed regulations, “it is unlawful for a covered operator to provide an addictive feed to a covered user unless: (1) the covered operator completes an age assurance method consistent with section 700.4 of this part to determine [that] the covered user is not a covered minor and the covered operator does not otherwise have actual knowledge of the covered user’s minor age status; or (2) the covered user is a covered minor and the covered operator has obtained verifiable parental consent consistent with subdivision (e) of this section to provide an addictive feed to the covered minor.”¹⁸ The deadline to submit comments on the attorney general’s proposed rules was December 1, 2025. The attorney general then has one year to finalize the rules. After the rules are finalized, they become effective 180 days later, meaning that covered operators should plan to update their policies and practices to comply with the SAFE for Kids Act by early 2027.

The SAFE Act governs “any person who operates or provides an addictive online platform and the person’s agents and affiliates involved in operating or providing an addictive online platform.”¹⁹ An addictive platform “means an online platform that offers or provides users one or more addictive feeds as a significant part of the services provided by such online platform. An addictive feed or multiple addictive feeds jointly are a significant part of the services provided by an online platform if 20% or more of the time spent by monthly active users on an online platform is spent on addictive feeds measured over any six-month period in the prior calendar year.”²⁰ A covered user is a “user of an online platform in the State of New York, not acting as an operator, or agent or affiliate of the operator of such online platform or any portion thereof.”²¹ A covered minor is “a user of an online platform in the State of New York for whom the covered operator has actual knowledge that the user is a minor.”²²

A social media platform is exempt from the SAFE for Kids Act if it does not meet the definition of an addictive online platform, or it satisfies the definition and has: (a) fewer than 5 million monthly active users, or (b) fewer than 20,000 active monthly users who are covered minors.²³ However, if the social media platforms’ primary user base is made up of minors, then the platform is not exempt from the SAFE for Kids Act.²⁴ If a social media platform is exempt from the SAFE for Kids Act, the social media platform should regularly monitor its status because if it no longer qualifies, then it has 180 days to comply with the SAFE Act after the first instance it is disqualified.²⁵ For all subsequent instances, the social media platform has 30 days to comply with the SAFE for Kids Act.²⁶

The attorney general may bring an action or special proceeding “whenever it appears that any person has engaged in or is about to engage in any of the acts or practices” that violate the SAFE for Kids Act²⁷ and seek an injunction or penalties up to $5,000 per violation.²⁸

The foregoing are just two recent laws that impact data privacy and protection. It is thus important that businesses and entities regularly review their compliance programs and seek assistance from experienced professionals.

Additional Assistance

For more information, please contact a member of our Data Privacy and Cybersecurity Industry Team or the Phillips Lytle attorney with whom you have a relationship.