Quick Hits
- Effective June 5, 2026, commercial establishments located in Erie County, New York, are prohibited from collecting, storing, retaining, selling, or otherwise monetizing data that can be used to identify individual customers.
- Local commercial establishments must disclose the amount and type of biometric identifier information they retain.
- Commercial establishments in Erie County must plan to permanently delete or destroy the data retained.
Key Provisions of the Law
Starting on June 5, 2026, all for-profit and not-for-profit businesses operating in Erie County, which includes Buffalo, the state’s second-largest city, are prohibited from collecting, storing, procuring, using, and selling or otherwise monetizing customer biometric identifier information.
Biometric identifier information is defined as information that “depict[s] or describe[s] physical, biological, or behavioral traits, characteristics, or measurements of or relating to an identified or identifiable person’s body.” Biometric identifier information includes images, descriptions, and recordings of an individual’s facial features, retina, fingerprints, voice, and characteristic movements or gestures, among other things.
Practical Implications for Employers and Businesses
The law does not affect a commercial establishment’s use of video footage and photography for surveillance or other purposes, but rather applies to the use of software, digital, or computing applications that assist with the identification of individuals based on physiological or biological characteristics.
Notably, the law also does not apply to employers that may collect biometric identifier information of their employees.
Next Steps
By July 5, 2026, commercial establishments in possession of biometric identifier information must submit written notice to the director of the Erie County Department of Public Advocacy Division of Consumer Protection regarding whether they are in possession of biometric identifier information.
Commercial establishments in possession of biometric identifier information must disclose the type and amount of biometric identifier information collected, and a written policy that includes the method and deadline by which they will permanently delete or destroy the biometric identifier information in their possession.
Commercial establishments will then have thirty days to permanently delete or destroy the biometric identifier information in their possession. Establishments must then submit an affidavit certifying that they have permanently deleted or destroyed the biometric identifier information.
Commercial establishments may be subject to a civil penalty each day they are found to be in violation of the law.
Key Takeaway
Commercial establishments operating in Erie County may want to review their policies on collecting customer biometric identifier information and to ensure they comply with the fast-approaching July 5, 2026, written notice deadline.
