AG’s new internet privacy guide for businesses

New York Attorney General Letitia James has issued a privacy guide for businesses that have a presence on the internet. The guide is designed to help businesses better protect visitors to their websites and identifies common mistakes businesses make when deploying tracking technologies.

“When New Yorkers visit websites, they deserve to have the peace of mind that they won’t be tracked without their knowledge, and won’t have their personal information sold to advertisers,” James said. “When visitors opt out of tracking, businesses have an obligation to protect their visitors’ personal information, and consumers deserve to know this obligation is being fulfilled.”

The Business Guide also provides information to help businesses comply with relevant New York laws, including ensuring that the representations made about tracking, whether express or implied, are truthful and not misleading. The Business Guide provides areas where businesses have run into trouble and tips for avoiding these issues.

According to the guide, “New York has yet to enact a comprehensive privacy law that specifically regulates when and how New York consumers can be tracked online. However, businesses’ privacy-related practices and statements are subject to New York’s consumer protection laws. These laws, which prohibit businesses from engaging in deceptive acts and practices, effectively require that websites’ representations concerning consumer privacy be truthful and not misleading. This means that statements about when and how website visitors are tracked should be accurate, and privacy controls should work as described.”

James reported that over a period of several months her office analyzed third-party tags and privacy controls on a variety of websites. The analysis found that 13 high-traffic e-commerce sites selling consumer products, such as apparel, books, and tickets to live events had privacy controls that did not work as described. Together, these sites saw an estimated 75 million visitors in March 2024.

The guide says that businesses need to use plain, clear language on their websites and that buttons that can be used by consumers to make choices about privacy need to be clearly labeled.

The guide is available via the attorney general’s website. Also available is a separate guide for consumers.