In Albany, the fight over who gets to profit from your most intimate health data is roaring back to life. Lawmakers are again weighing how information from period trackers, fitness wearables and genetic tests can be collected, used and sold, and reproductive-rights groups are squaring off against the tech industry over the answer. Inside the Capitol, sponsors, advocates and lobbyists are trading letters and applying pressure as they gear up for another push.
As first reported by Crain's New York Business, the clash centers on a package that includes the New York Health Information Privacy Act and several companion bills meant to plug holes in existing privacy law. Supporters frame the effort as a targeted response to post-Dobbs privacy risks, while industry groups warn that the language is so broad it could scramble a wide range of everyday online services.
What the bills would do
The sponsors of S.929/A.2141 say their proposal would force apps and websites to obtain affirmative consent before holding on to health-related information, and it would prohibit the sale of what the bill calls "regulated health information." The package would also give New Yorkers rights to access and delete certain electronic health data, and it would block geofencing and other location-based advertising keyed to health-care visits. Backers argue that the framework fills a gap that HIPAA does not cover and is designed to protect people seeking reproductive and gender-affirming care, according to the New York State Senate.
Why the tech lobby objects
A broad industry coalition led by Tech:NYC and other business associations argues the bill’s definitions and rules for data processors are too sweeping and too hard to implement in practice. The coalition warns that ordinary information such as IP addresses, payment records and inferred data signals could get dragged into a tightly regulated health category, and that the bill’s definition of a data "sale" does not clearly exempt routine transfers to service providers. Those objections are laid out in a veto request from business groups posted on Empire Report.
Advocates say protections are urgent
On the other side, Planned Parenthood Empire State Acts, the NYCLU and allied advocates say New York cannot afford to wait, pointing to episodes like the 23andMe bankruptcy and documented data sharing by femtech apps. They argue the bills would clearly bar health-related data from being treated as a commodity and would limit how digital breadcrumbs can be used to target people for criminal investigations or advertising. Those points are featured in advocacy materials and sponsor statements circulating in Albany, as cited by the New York State Senate.
Where the fight stands
Gov. Kathy Hochul vetoed the core bill in December 2025 after heavy industry pushback, which halted the package for the moment but did not settle the underlying dispute. Legal analysts and policy organizations have said the veto was driven by concerns about the bill’s scope and how it would be implemented, and the sponsors have signaled plans to refine the language and bring it back in 2026. The veto and the talk of trying again were reported by Privacy Daily.
What it would mean for New Yorkers
If something like S.929/A.2141 eventually becomes law, it would significantly tighten what companies can do with health signals that fall outside HIPAA, from menstrual-cycle logs to wearable telemetry. It could also give users clearer abilities to see and delete that data. Right now, many femtech and fitness apps share information with advertising networks and analytics firms, a pattern documented through testing and reporting by Consumer Reports. But industry groups and advocates are still far apart on how to build consent systems, compliance obligations and carve-outs that protect privacy without breaking basic services.
In the near term, expect another round of amendments, lobbying and late-night negotiations when the Legislature reconvenes. For New Yorkers, the outcome will decide whether the state becomes one of the toughest regulators of consumer health data in the country, or whether business-backed changes trim the protections lawmakers first put on the table.
