{"page":"/blog/new-york-health-information-privacy-act-advertising","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Component","Bill section","What would change"],"rows":[["Health-context pixels and SDK events","1120(2)-(3); 1122(1)(b)","Authorization per processing category; advertising is not a permitted purpose"],["Bid requests with health context","1120(2)","Device IDs and IPs linked to health context are regulated health information"],["Audience sales and data licensing","1122(1)(a)","Sale to third parties barred on the text"],["Platform optimisation across clients","1125(2)(d)","No combining for service providers"],["Consent screens","1122(2)(a)","Separate, 12-point, per-category, no re-ask for nine months"],["Deletion pipelines","1123(2)","30 days, passed to every recipient from the prior year"],["Retention","1124","Dispose within 60 days after the purpose ends"]],"sourceUrls":[[],[],[],[],[],[],[]]}