A cookie banner is a statement a business makes to every visitor. When it offers "Reject" and the site keeps sending visitor data to advertising platforms after the visitor clicks it, the statement and the conduct do not match. In New York, the statute that addresses that kind of mismatch is General Business Law § 349.
What § 349 says today
New York has amended § 349, and the current text is broader than the version many summaries describe. Section 349(a) now reads:
Unfair, deceptive, or abusive acts or practices in the conduct of any business, trade or commerce or in the furnishing of any service in this state are hereby declared unlawful.
The amended section also defines when a practice is "unfair" and when it is "abusive." The Attorney General can sue to stop any of the three and to obtain restitution under § 349(b).
Who can sue, and for what
The private claim is in § 349(h), and it is limited to deceptive acts and practices:
In addition to the right of action granted to the attorney general pursuant to this section, any person who has been injured by reason of any deceptive act or deceptive practice made unlawful by this section may bring an action in such person's own name to enjoin such deceptive act or deceptive practice, an action to recover such person's actual damages or fifty dollars, whichever is greater, or both such actions. The court may, in its discretion, increase the award of damages to an amount not to exceed three times the actual damages up to one thousand dollars, if the court finds the defendant willfully or knowingly violated this section. The court may award reasonable attorney's fees to a prevailing plaintiff.
In short, an injured person can seek:
- an order stopping the deceptive practice;
- actual damages or $50, whichever is greater;
- up to three times actual damages, capped at $1,000, for a willful or knowing violation; and
- reasonable attorney's fees if they prevail.
Why cookie banners fit
A banner that offers "Reject all" or "Necessary only" tells the visitor what will happen if they choose it: the site will not share their activity with advertising and analytics companies. A privacy policy that says "we do not share health information with advertisers" makes a similar promise.
When the site's own code keeps sending page addresses, events, and cookie identifiers to Meta, Google, or TikTok after the visitor refuses, the visitor was told one thing and the site did another. That is the gap § 349 is about. The evidence is concrete: the banner's own words, and the requests the browser sent after the refusal, with their times.
Common ways it happens:
- the banner records the choice but tags are not tied to it;
- Google's advanced consent mode keeps sending cookieless measurements after a refusal (see Google consent mode: basic versus advanced);
- pixels hard-coded into the site load whatever the visitor chooses;
- a server-side container keeps forwarding events (see Meta Conversions API and server-side tagging).
How § 349 relates to the wiretap laws
New York is a one-party consent state for eavesdropping under N.Y. Penal Law § 250.05, but the federal Wiretap Act applies to New York websites as it does everywhere, and its party exception does not protect an interception made "for the purpose of committing any criminal or tortious act." See Federal Wiretap Act for Websites and State Wiretap Laws and Website Tracking.
What a business with New York visitors should do
- Run the five-minute Reject button test on your site today.
- Make the banner's words match what the site does. If "Reject" cannot stop a tag, remove the tag or change the banner.
- Make the privacy policy match too. Name each vendor and say what it receives.
- Keep records of the banner text, the consent platform's settings, and your tests, with dates.
Sources
Links checked on October 22, 2026. The statute is quoted from the New York State Senate's current revision of § 349, read that day.