New York Assembly Member Brian Kavanaugh (D-74) introduced the "Online Consumer Protection Act" (A.B. 4809), legislation which would restrict "online preference marketing", defined as "a type of advertisement delivery and reporting whereby data is collected to determine or predict consumer characteristics or preference for use in advertisement delivery on the internet."

According the Act, "No publisher of a webpage or advertising network contracted with a publisher shall collect personally identifiable information for the purposes of online preference marketing", unless consumer consent has been granted. Any other information collected by such a "publisher of a webpage or advertising network contracted with a publisher" for "online preference marketing" that falls outside the definition of "personally identifiable information" would require an opt out.

The Act defines "personally identifiable information" as "data that, by itself, can be used to identify, contact or locate a person, including name, address, telephone number, sensitive medical or financial data, sexual behavior, sexual orientation, or email address." The term "publisher" would mean "any company, individual or other group that has a website, webpage or other internet page." A.B. 4809 would also define an "advertising network" as "any company, individual or other group that is collecting online consumer activity for the purposes of ad delivery."

The Act would also require that, "An advertising network shall post clear and conspicuous notice on the home page of its own website about its privacy policy and its data collection and use practices related to its advertising delivery activities. If a publisher has contracted with an advertising network, the publisher shall post clear and conspicuous notice on its website that describes the collection and use of information by the advertising network. If the advertising network engages in online preference marketing, the privacy policies of both the advertising network and the publisher shall describe the ability to opt-out of online preference marketing by such network." The legislation would also require "reasonable efforts" on the part of an ad network "to protect the data it collects or logs as a result of ad delivery and reporting from loss, misuse, alteration, destruction or improper access."

Violations could be prosecuted by the state Attorney General "to enjoin further violation" and "to recover up to two hundred fifty dollars for each instance in which identifying information is collected from a person in violation" of the consumer consent provisions. A court "may increase the damages up to three times the damages allowed... where the defendant has been found to have engaged in a pattern and practice of violating the provisions".

As usual, vagueness in the definition of terms like "online preference marketing" could ensnare bona fide survey research conducted via online tracking. Therefore, MRA has sought to amend or defeat A.B. 4809.