Each card summarizes what the official source says, then what it means for an AI workflow. Follow the source link for the full requirements and any exceptions.
AI in hiring: Local Law 144
The City's Department of Consumer and Worker Protection (DCWP) says the law prohibits employers and employment agencies from using an automated employment decision tool unless it has had a bias audit within one year of its use, information about the audit is publicly available, and certain notices have been given to employees or job candidates. DCWP notes the notice must be provided 10 business days before the tool is used.
For your plan: before a tool screens, scores or ranks applicants, ask whether it counts as an automated employment decision tool, and ask the vendor for its bias audit and public summary.
NYC DCWP: Automated Employment Decision Tools
Automated scheduling: Fair Workweek
Retail employers covered by the law (retail businesses with 20 or more employees that sell primarily consumer goods at one or more NYC stores) must give schedules 72 hours before the first shift and cannot schedule on-call shifts. Fast food employers (establishments that are part of a chain, primarily serve food and beverages, offer limited service, and are one of 30 or more such establishments nationally) must give schedules 14 days in advance and pay premiums for schedule changes or clopenings. DCWP also publishes recommended specifications and a checklist for fast food scheduling software.
For your plan: if software builds or changes your schedules, check that its notice periods, consent steps and records match the rule that covers you.
NYC DCWP: Fair Workweek, retail employers · DCWP retail FAQ (PDF) · NYC DCWP: Fair Workweek, fast food employers · DCWP fast food FAQ (PDF) · DCWP software specifications checklist (PDF)
Cameras and recognition: biometric identifier information
Under the City's Administrative Code, a retail store, food and drink establishment, or place of entertainment that collects, retains, converts, stores or shares customers' biometric identifier information must post a clear and conspicuous sign near all customer entrances, in a form DCWP prescribes by rule. The code's definition of a retail store includes an establishment where services are provided to consumers at retail, so service businesses should check it too. The code makes it unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from that information. It names face geometry, fingerprints, voiceprints and retina or iris scans as examples.
For your plan: before adding face or voice recognition to cameras, check-in or loyalty tools, decide whether you need it at all, and if you do, plan the sign and confirm the vendor will not sell or trade the data.
NYC Admin. Code §§ 22-1201 to 22-1202
Personalized prices: Algorithmic Pricing Disclosure Act
The disclosure rule in New York General Business Law § 349-a covers personalized algorithmic pricing, which the law defines as dynamic pricing set by an algorithm that uses personal data. Personal data means "any data that identifies or could reasonably be linked, directly or indirectly, with a specific consumer or device." A business that sets a price this way and, directly or indirectly, advertises, promotes, labels or publishes that price to a consumer in New York, using personal data specific to that consumer, must include with it a clear and conspicuous disclosure that states: "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA". The law defines that as a disclosure "in the same medium as, and provided on, at, or near and contemporaneous with every advertisement, display, image, offer or announcement of a price for which notice is required, using lettering and wording that is easily visible and understandable to the average consumer."
Prices that change only with conditions such as inventory or time of day, set without personal data, are not personalized algorithmic pricing under the law's definitions. The law also defines a consumer as "a natural person who is seeking or solicited to purchase, lease or receive a good or service for personal, family or household use," and lists exceptions, including for businesses subject to the insurance law and certain financial institutions; read the statute for the full definitions and exceptions. The Attorney General's alert said the law would take effect on November 10, 2025, and described personalized pricing schemes as most common in apps and loyalty programs.
For your plan: if an AI tool would set a price or discount using a customer's personal data, plan the disclosure before launch, or keep offers the same for everyone. Ask any pricing vendor exactly which data its tool uses, including device data.
NY General Business Law § 349-a (statute, NY Senate) · NY Attorney General: algorithmic pricing alert
Customer records: the SHIELD Act
The Attorney General says the SHIELD Act requires any person or business that maintains private information to adopt administrative, technical and physical safeguards, including choosing service providers that can maintain appropriate safeguards and requiring those safeguards by contract. It expanded the data elements the law covers; the Attorney General lists biometric information, username or email address, and password credentials among the additions. Follow the source for the exact definition of private information. The law also sets notice duties after a breach.
For your plan: before connecting an AI tool to customer records, know what it stores, who can access it, and what your contract with the vendor requires.
NY Attorney General: SHIELD Act
