N.Y. State Technology Law § 203

§ 203. Model internet privacy policy. 1. The office shall adopt rules\nand regulations in conformity with the provisions of this article, and\nspecify a model internet privacy policy for state agencies that maintain\nstate agency websites. Such model privacy policy shall include, but not\nbe limited to, the following elements:\n (a) a statement of any information, including personal information,\nthe state agency website will collect with respect to the user and the\nuse of the information;\n (b) the circumstances under which information, including personal\ninformation, collected may be disclosed;\n (c) whether any information collected will be retained by the state\nagency, and, if so, the period of time that such information will be\nretained;\n (d) the procedures by which a user may gain access to the collected\ninformation pertaining to that user;\n (e) the means by which information is collected and whether such\ncollection occurs actively or passively;\n (f) whether the collection of information is voluntary or required,\nand the consequences, if any, of a refusal to provide the required\ninformation; and\n (g) the steps being taken by the state agency to protect the\nconfidentiality and integrity of the information.\n 2. Each state agency that maintains a state agency website shall adopt\nan internet privacy policy which shall, at a minimum, include the\ninformation required by the model internet privacy policy. Each state\nagency shall post its internet privacy policy on its website. Such\nposting shall include a conspicuous and direct link to such privacy\npolicy.\n 3. The model internet privacy policy specified by the office shall\nalso be made available at no charge to other public and private\nentities.\n