N.Y. State Technology Law § 204
No state agency shall collect personal information concerning a user through a state agency website, or disclose personal information concerning a user to any person, firm, partnership, corporation, limited liability company or other entity, including internal staff who do not need the information in the performance of their official duties pursuant to a state agency purpose meeting the requirements of subdivision one of section two hundred six of this article, unless such user has consented to the collection or disclosure of such personal information. For the purposes of this section, the voluntary disclosure of personal information to a state agency by a user through a state agency website, whether solicited or unsolicited, shall constitute consent to the collection or disclosure of the information by the state agency for the purposes for which the user disclosed it to the state agency, as reasonably ascertainable from the nature and terms of the disclosure.
N.Y. State Technology § 204