N.Y. State Technology Law § 204

§ 204. Collection and disclosure of personal information. No state\nagency shall collect personal information concerning a user through a\nstate agency website, or disclose personal information concerning a user\nto any person, firm, partnership, corporation, limited liability company\nor other entity, including internal staff who do not need the\ninformation in the performance of their official duties pursuant to a\nstate agency purpose meeting the requirements of subdivision one of\nsection two hundred six of this article, unless such user has consented\nto the collection or disclosure of such personal information. For the\npurposes of this section, the voluntary disclosure of personal\ninformation to a state agency by a user through a state agency website,\nwhether solicited or unsolicited, shall constitute consent to the\ncollection or disclosure of the information by the state agency for the\npurposes for which the user disclosed it to the state agency, as\nreasonably ascertainable from the nature and terms of the disclosure.\n