Can I request deletion of my personal data from a company in New York?

What the Law Says

New York does not yet have a comprehensive consumer data deletion right in effect—but one is coming. The New York Privacy Act (NYPA), signed in 2024 and set to take effect on July 25, 2025, will grant residents the right to request deletion of their personal data from covered businesses.

The NYPA applies to businesses that conduct business in New York *and* either (1) have annual gross revenues of $25 million or more; (2) derive over 25% of their gross revenue from selling personal data; or (3) process or control personal data of 100,000 or more consumers annually.

Once effective, the law requires covered businesses to honor verified consumer requests to delete personal data 'without undue delay'—and no later than 30 days after receiving the request. Businesses must also inform consumers of their rights and provide at least two methods to submit requests (e.g., email, web form).

Until NYPA takes effect, the primary privacy law in New York is the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act). However, the SHIELD Act focuses on data security obligations—not consumer deletion rights. It does not give individuals a statutory right to request deletion.

Statutory Text

A consumer shall have the right to request that a controller delete personal data concerning the consumer.

— New York Privacy Act, S.567-B, § 5 — Consumer Rights

Statutory Text

A controller shall comply with such a request without undue delay, but in any case within thirty days of receipt of the request.

— New York Privacy Act, S.567-B, § 5(3)(a)

Sources