What actually applies: the recording and interception statute
This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.
- Citation
N.Y. Penal Law § 250.05- Consent regime
- One-party consent
- Private lawsuits
- No private right of action created by the statute.
- Damages named
- No figure named in the statute
- Observed filing volume
- High
New York's eavesdropping statute authorizes no civil penalties. New York website-tracking claims are brought under General Business Law § 349 instead — see below.
Health data law in New York
General Business Law § 349 — deceptive acts and practices
- Citation
N.Y. Gen. Bus. Law § 349(h)- Private lawsuits
- Yes
- Damages named
- Actual damages or $50, whichever is greater; trebled up to $1,000 for a willful or knowing violation
New York has no comprehensive privacy law and no civil remedy under its eavesdropping statute, so § 349 is where website-tracking claims land. A privacy policy that says 'we do not sell your data' while ad pixels fire is the classic § 349 fact pattern — the deceptive act is the mismatch, not the tracking.
New York Health Information Privacy Act — NOT LAW
- Citation
S929 (2025), vetoed; reintroduced as S9269 (2026)- Private lawsuits
- No private right of action
- Damages named
- Not stated
Passed both chambers in January 2025 and was vetoed by the Governor in December 2025. A revised version was introduced in the 2026 session and has not been enacted. It is listed here only because it is widely and wrongly reported as being in force; nothing in it applies today.
Your state is not the only one that applies
Wiretap exposure follows the visitor, not the practice. A New York practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from New York wherever your servers are.
Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.
The federal floor
HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.
Neighbouring states
Connecticut · Massachusetts · New Jersey · Pennsylvania · Vermont
Sources
- Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
- DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
- Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/
Figures last reviewed July 25, 2026.