Overview
On May 9, New York Governor Kathy Hochul signed several significant consumer protection measures into law as part of the state's Fiscal Year 2026 Enacted Budget (FY 26 Budget).1 These legislative changes aim to impose new obligations on several industries and include four pieces of legislation within the Transportation, Economic Development and Environmental Conservation (TED) bill, addressing (1) cancellation of online subscriptions, (2) standardized online retail returns and refunds, (3) oversight of "Buy Now, Pay Later" (BNPL) loans, and (4) surveillance pricing. The reforms mark one of the broadest expansions of state-based consumer protections and will have wide-reaching implications for a broad range of consumer-facing businesses operating in New York. Many of these reforms carry forward policy positions similar to those of the Consumer Financial Protection Bureau (CFPB) under the Biden administration.
Key Legislative Components
Simplified Subscription Cancellation Requirements:
The FY 26 Budget codifies a new obligation for subscription-based businesses to ensure that cancellation processes are as simple as the enrollment processes. The New York Department of Financial Services (NYDFS) characterizes Part V of the TED bill as "requiring businesses to notify consumers of upcoming renewals and price changes as well as provide clear instructions on how to cancel subscriptions."2 The goal is to make canceling a subscription as easy as it is to sign up for it.
New York law already contains several provisions regarding necessary disclosures related to automatic renewals. However, the new amendments require businesses to make an automatic renewal or continuous service offer to "provide the consumer with the option to cancel at any time through the same medium by which the consumer accepted the automatic renewal."3 Such businesses must also provide clear and conspicuous disclosure of the cancellation mechanism, "provided that any cancellation mechanism must be at least as easy to access and use as the mechanism by which the consumer provided consent."4
The New York law also provides certain specifications for disclosures to be considered "clear and conspicuous." For example, a disclosure "must use diction and syntax understandable to ordinary consumers and appear in each language in which the representation that requires disclosure appears."5 Furthermore, the amendment provides special requirements for solely visual or solely audible disclosures, visual disclosures, audible disclosures, and Internet disclosures.6
Notably, in some respects, these requirements go beyond the Federal Trade Commission's (FTC) amended Negative Option Rule, which becomes effective on July 14, 2025. Under the FTC's rule, sellers offering negative option features (such as automatic renewals or free-to-pay conversions) must provide a "simple mechanism" for cancellation that is at least as easy as the method used to initiate the subscription.7 While both rules emphasize parity between enrollment and cancellation methods and clear disclosures, New York's law includes more granular mandates regarding linguistic accessibility and formatting of visual and audio communications. For example, New York requires that disclosures be made available in every language in which the triggering marketing materials appear—a requirement not expressly mirrored in the FTC Rule.
Standardized Online Retail Returns and Refunds
The FY 26 Budget requires online retailers to prominently display return and refund policies in a clear and accessible manner, requiring "online retail sellers to post return and refund policies in a way that is easily accessible for consumers."8 It also imposes a minimum standard for refund policies.
This legislation applies to "retail sellers," which is limited to businesses engaged in retail sales to the New York public with 500 or more statewide employees or annual gross revenues from New York sales of US $500,000 or more.9 However, a "retail seller" does not include a business that facilitates transactions between businesses and consumers, such as advertising or marketing firms or payment processors.10 Likewise, this does not apply to perishable goods, goods with certain disclosures (e.g., no returns accepted), goods used after purchase, customized goods received as ordered, goods not returned with their original packaging, and goods that cannot be resold due to health considerations.11
Under this law, retail sellers are required to conspicuously post their refund policy, either at the point of sale or, for online transactions, on the relevant webpage, and on receipts or order forms.12 Furthermore, retail sellers who fail to meet these posting and disclosure requirements must offer a full cash refund or credit, at the buyer’s option, for at least 30 days following the purchase of goods, provided the merchandise is not used or damaged.13
Oversight of BNPL Loans
The FY 26 Budget establishes a new licensing regime for BNPL providers under new Article 9-A of the Banking Law. It also includes other provisions, such as disclosure requirements and data privacy protections, which serve as further consumer protection safeguards.
The amendments in Part Y of the TED bill establish the requirement that no person (except certain exempt organizations) may act as a BNPL provider without a license from the superintendent.14 Broad discretion was given to the superintendent to establish the application requirements, including "rules and regulations setting capital requirements" and "prescribing a methodology to calculate capital requirements."15 However, the superintendent must, in deciding to give a license, determine that the applicant's "financial responsibility . . . experience, character, and general fitness . . . are such as to command the confidence of the community and to warrant the belief that the business will be conducted honestly, fairly, and efficiently."16
In addition to licensure, the statute authorizes the superintendent to supervise and examine BNPL licensees, investigate potential violations,17 and promulgate rules necessary to enforce the law. This includes defining unfair, deceptive, or abusive acts or practices (UDAAP) specifically in connection with BNPL products.18
Importantly, this authority expressly enables NYDFS to define and prohibit not only deceptive practices—which are already covered under Section 349 of the New York General Business Law—but also "unfair" and "abusive" acts or practices in connection with BNPL products. This broad statutory language reflects a significant expansion of New York’s consumer protection framework, at least with respect to BNPL lending. Under existing state law, private claims under Section 349 are limited to deceptive conduct and do not reach unfairness or abusiveness unless independently deceptive. The amendments also describe grounds for the revocation of a BNPL provider license and require a prospective purchaser of a BNPL provider to submit an application.19
The amendments include prohibitions specific to BNPL providers. For example, they include provisions prohibiting unfair, deceptive, or abusive acts or practices, fraud, misapplying loan payments, providing inaccurate information to consumer reporting agencies, and making false or misleading statements or omissions in connection with government reports or investigations.20 Likewise, BNPL providers are subject to New York rate limitations, and the superintendent is authorized to promulgate rules and regulations limiting late fees.21
There are also several requirements meant to function as consumer protection safeguards. For example, licensees must disclose the terms of the BNPL contract to consumers, determine a consumer’s ability to repay the BNPL loan, maintain policies and procedures to maintain accurate data that can be reported to credit reporting agencies, provide refunds or credits for goods and services purchased in connection with a BNPL loan, resolve disputes "in a manner that is fair and transparent to consumers," and must seek consent before using, selling, or sharing consumer data other than in connection with the BNPL loan.22
Surveillance Pricing
The NYDFS claims the FY 26 Budget “includes first-in-the-nation legislation that requires businesses to disclose clearly to consumers when a price was set by an algorithm using their personal data, subject to certain exceptions."23 It also includes an antidiscrimination provision regulating the use of "protected class data."
The amendments in Part X of the TED bill make it a deceptive act or practice "to knowingly advertise, promote, label, or publish a statement, display, image, offer or announcement of personalized algorithmic pricing using consumer protected data specific to a particular individual without a clear and conspicuous disclosure that states: 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.'"24
Furthermore, the amendments forbid the use of "protected class data in setting a price for, offering, marketing, or selling any good or service" if such use would result in the withholding or denial of any accommodation, advantage, or privilege accorded to others, or if the price for such goods or services is different from the price offered to others based on such use.25 Protected class data refers to any information that, in combination or by implication, identifies a characteristic legally protected from discrimination under federal or New York state law. This includes, for example, "ethnicity, national origin, age, disability, sex, sexual orientation, gender identity and expression, pregnancy outcomes and reproductive health care."26
Takeaways
The consumer protection measures enacted through New York's FY 2026 budget represent a significant shift in the regulatory landscape, particularly for fintechs, digital platforms, and financial institutions. Businesses offering subscription services to New Yorkers or operating in the e-commerce space should not assume that compliance with the FTC rule alone is sufficient; they should also evaluate and, where necessary, tailor their cancellation workflows and immediately assess their user interfaces and consumer communications to ensure that cancellation procedures and refund policies are clearly disclosed and compliant with the new transparency standards to meet the more detailed obligations imposed under state law. BNPL providers—many of which previously operated outside the scope of state financial licensing—will now face mandatory licensure by NYDFS and must implement robust compliance frameworks addressing fee limitations, credit reporting, and disclosure obligations under the newly enacted N.Y. Banking Law §§ 741-748. Retailers that employ algorithmic pricing strategies must prepare to disclose when personalized data is used to determine prices, signaling a broader push for transparency in AI-driven commerce. Finally, banks and credit unions should anticipate increased scrutiny of overdraft and NSF fees and begin aligning their practices with NYDFS's forthcoming regulations, including adopting internal protocols and training staff to detect financial exploitation. Collectively, these reforms highlight New York's increasingly aggressive regulatory posture and may be a harbinger of similar legislative activity in other states, given the CFPB's stated priority shift away from these issues.
1Governor Hochul Signs New Legislation to Protect Consumers and Keep Money in New Yorkers’ Pockets as Part of the FY 2026 Budget, N.Y. Dep’t of Fin. Servs. (May 9, 2025), https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20250509_2 hereinafter Press Release.
2Id.
3N.Y. State Div. of the Budget, FY 2026 New York State Executive Budget: Transportation, Economic Development and Environmental Conservation Article VII Legislation 136 (2025) hereinafter TED Bill.
4Id.
5Id. at 134.
6Id.
7 See Fed. Trade Comm'n, Negative Option Final Rule, 89 Fed. Reg. 90476 (Nov. 15, 2024); 16 C.F.R. § 425.7 (2024)
8Press Release, supra note 1.
9 TED Bill, supra note 3, at 130-31.
10 Id. at 131.
11 Id. at 132.
12 Id. at 131.
13Id. at 131-32.
14 Id. at 145.
15 Id. at 146.
16Id.
17Id. at 150-51.
18Id. at 155-56.
19 Id. at 147, 149-50.
20Id. at 152.
21 Id.
22 Id. at 153-55.
23Press Release, supra note 1.
24TED Bill, supra note 3 at 141-42.
25 Id. at 142.
26Id.
