Establishes the NY digital choice act requiring social media companies to provide covered users with a copy of the covered user's social graph at the request of the covered user; defines terms; provides requirements for the interoperability of covered users' data; grants the attorney general the authority to promulgate rules and regulations and enforce such provisions.
STATE OF NEW YORK
________________________________________________________________________
8963--B
2025-2026 Regular Sessions
IN ASSEMBLY
August 13, 2025
___________
Introduced by M. of A. BORES, SIMON, ROSENTHAL, HYNDMAN, TORRES, SIMONE,
CONRAD, GLICK, LUNSFORD, K. BROWN, BEEPHAN, TAPIA -- read once and
referred to the Committee on Consumer Affairs and Protection --
committee discharged, bill amended, ordered reprinted as amended and
recommitted to said committee -- recommitted to the Committee on
Consumer Affairs and Protection in accordance with Assembly Rule 3,
sec. 2 -- committee discharged, bill amended, ordered reprinted as
amended and recommitted to said committee
AN ACT to amend the general business law, in relation to establishing
the NY digital choice act
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new article
2 48 to read as follows:
3 ARTICLE 48
4 NY DIGITAL CHOICE ACT
5 Section 1800. Short title.
6 1801. Definitions.
7 1802. Portability.
8 1803. Interoperability.
9 1804. Data rights.
10 1805. Rulemaking authority.
11 1806. Enforcement by attorney general.
12 1807. Severability.
13 1808. Safe harbor.
14 § 1800. Short title. This article shall be known and may be cited as
15 the "NY digital choice act".
16 § 1801. Definitions. As used in this article, the following terms
17 shall have the following meanings:
18 1. "Open protocol" means a publicly available set of technical rules
19 that:
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD13423-08-6
A. 8963--B 2
1 (a) enables interoperability and data exchange between social media
2 platforms by providing a means whereby multiple social media platforms
3 can access a covered user's social graph;
4 (b) is free from licensing fees and patent restrictions; and
5 (c) governs how social media platforms communicate and exchange data.
6 2. (a) "Social graph" means:
7 (i) a covered user's social connections with secondary users;
8 (ii) content created by a covered user;
9 (iii) the covered user's responses to secondary users' content,
10 including comments, reactions, mentions, reports, shares, and other
11 engagements;
12 (iv) secondary users' responses to the covered user's content;
13 (v) metadata for subparagraphs (i), (ii), (iii), and (iv) of this
14 paragraph; and
15 (vi) relational references sufficient to maintain the associations
16 among data elements described in subparagraphs (i), (ii), (iii), and
17 (iv) of this paragraph.
18 (b) "Social graph" does not include a secondary user's content and
19 responses that have been designated private by such secondary user,
20 including private messages.
21 3. "Content" has the same meaning as in section eleven hundred of this
22 chapter.
23 4. "Social media company" has the same meaning as in section eleven
24 hundred of this chapter.
25 5. "Social media platform" has the same meaning as in section eleven
26 hundred of this chapter.
27 6. "Covered user" has the same meaning as in section fifteen hundred
28 of this chapter.
29 7. "Secondary user" means a user of a website, online service, online
30 application, or mobile application that is developed, deployed, or oper-
31 ating in whole or in part in the state and that is not acting as an
32 operator, or agent or affiliate of an operator, of such website, online
33 service, online application, or mobile application, or any portion ther-
34 eof, irrespective of such user's physical location.
35 8. "Data portability" means the ability of covered users of social
36 media platforms to retain existing social graphs without impairment of
37 quality, reliability, or convenience when such information is trans-
38 ferred from one social media platform or third party to another.
39 9. "Continuous, real-time data sharing" means data sharing between
40 platforms conducted no less frequently than every thirty seconds.
41 § 1802. Portability. 1. If a covered user requests a copy of such
42 covered user's social graph under this article, a social media company
43 shall, within five business days, provide the social graph or user-se-
44 lected parts of the social graph, in a format that:
45 (a) allows for data portability, to the extent technically feasible;
46 (b) is readily usable by the covered user; and
47 (c) allows the covered user to transmit the data to another social
48 media platform or third party without impediment if the social media
49 platform or third party processes the data by automated means.
50 2. A social media company shall adopt an accessible, prominent, and
51 persistent method for covered users to request their social graph data.
52 § 1803. Interoperability. 1. A social media company shall implement a
53 transparent, third-party-accessible interoperability interface or inter-
54 faces to allow covered users to choose to:
A. 8963--B 3
1 (a) export a covered user's social graph or user-selected parts of the
2 social graph to the social media platforms designated by the covered
3 user; and
4 (b) enable third parties to access social graph data created by the
5 covered user and to be notified when new or updated social graph data is
6 available, with the covered user's permission.
7 2. To achieve interoperability under subdivision one of this section,
8 a social media company shall:
9 (a) utilize an open protocol;
10 (b) facilitate and maintain interoperability and continuous, real-time
11 data sharing with other social media platforms through an interoperabi-
12 lity interface, based on reasonable terms that do not discriminate
13 between social media platforms;
14 (c) establish reasonable and proportionate thresholds related to the
15 frequency, nature, and volume of requests, beyond which the social media
16 company may assess a fair, reasonable, and non-discriminatory fee for
17 such access; and
18 (d) disclose to other social media companies complete, accurate, and
19 regularly updated documentation describing access to the interoperabi-
20 lity interface required under this section; and
21 (e) publicly disclose the open protocol that the social media company
22 intends to use for purposes of paragraph (a) of this subdivision.
23 3. A social media company or third party that accesses an interoper-
24 ability interface shall take reasonable steps to meet platform integrity
25 standards, including data security, data privacy, and abuse-mitigation
26 practices necessary to preserve user protections and secure any data
27 such company or third party acquires, processes, or transmits.
28 4. A social media company or third party may not export or receive a
29 covered user's social graph through the interoperability interface,
30 except with the covered user's consent.
31 5. A social media company shall adopt an accessible, prominent, and
32 persistent method for covered users to give consent for data sharing
33 with other social media platforms or third parties through the interop-
34 erability interface and shall implement such user's instructions within
35 five business days of receipt of such request.
36 6. A social media company is not required to:
37 (a) provide access to:
38 (i) inferences, analyses, or derived data that the social media compa-
39 ny has generated internally about a user; or
40 (ii) proprietary algorithms, ranking systems, or other internal oper-
41 ating mechanisms; or
42 (b) transmit data that meets all of the following criteria:
43 (i) such data is stored or structured in a proprietary format;
44 (ii) no open, industry-standard format is reasonably available; and
45 (iii) transmitting the data would disclose information described in
46 paragraph (a) of this subdivision; or
47 (c) import any data or treat imported data any differently from any
48 other data on their service.
49 7. A social media company shall give secondary users an opportunity to
50 opt out of transferal of such secondary user's public data from one
51 social media platform or third party to another.
52 § 1804. Data rights. Upon specific request from a covered user, a
53 social media company shall allow such covered user to delete the data in
54 such covered user's social graph, as well as any data that has been
55 designated private by such covered user.
A. 8963--B 4
1 § 1805. Rulemaking authority. The attorney general may promulgate such
2 rules and regulations as are necessary to identify open protocols that
3 satisfy the requirements of this article.
4 § 1806. Enforcement by attorney general. In addition to any other
5 remedies provided by law, whenever there shall be a violation of this
6 article, application may be made by the attorney general in the name of
7 the people of the state of New York to a court or justice having juris-
8 diction by a special proceeding to issue an injunction, and upon notice
9 to the defendant of not less than five days, to enjoin and restrain the
10 continuance of such violations. If it shall appear to the satisfaction
11 of the court or justice that the defendant has, in fact, violated this
12 article, an injunction may be issued by such court or justice enjoining
13 and restraining any further violation, without requiring proof that any
14 person has, in fact, been injured or damaged thereby. In any such
15 proceeding, the court may make allowances to the attorney general as
16 provided in paragraph six of subdivision (a) of section eighty-three
17 hundred three of the civil practice law and rules. Whenever the court
18 shall determine that a violation of this article has occurred, the court
19 may impose a civil penalty of not more than twenty-five hundred dollars
20 for each violation.
21 § 1807. Severability. If any clause, sentence, paragraph, subdivision,
22 section or part of this article shall be adjudged by any court of compe-
23 tent jurisdiction to be invalid, such judgment shall not affect, impair,
24 or invalidate the remainder thereof, but shall be confined in its opera-
25 tion to the clause, sentence, paragraph, subdivision, section, or part
26 thereof directly involved in the controversy in which such judgment
27 shall have been made.
28 § 1808. Safe harbor. A social media company shall not be in violation
29 of paragraph (b) of subdivision two of section eighteen hundred three of
30 this article for a temporary loss of continuous, real-time data sharing
31 if the social media company demonstrates that:
32 1. the social media company made good faith efforts to maintain
33 continuous, real-time data sharing; and
34 2. the social media company took reasonable steps to restore data
35 sharing as soon as practicable.
36 § 2. This act shall take effect July 1, 2027. Effective immediately,
37 the addition, amendment and/or repeal of any rule or regulation neces-
38 sary for the implementation of this act on its effective date are
39 authorized to be made and completed on or before such effective date.
