Camera-related state law

The eavesdropping statute is NY Penal Law 250.05, which makes intentional overhearing or recording of a telephonic, telegraphic, or other electronic communication without the consent of a sender or receiver a class E felony. The statute is paired with related definitions in Penal Law Article 250 (Offenses Against the Right to Privacy). New York is a one-party consent state because consent of a sender or receiver is sufficient: a participant can record without notifying the other party.

Video surveillance is treated more permissively. Recording video in places where a person has no reasonable expectation of privacy is generally lawful. Hidden cameras in places where privacy is expected (restrooms, locker rooms, dressing rooms, hotel guest rooms) trigger separate exposure under NY Penal Law 250.45 (Unlawful Surveillance), which is also a felony. Posted notice at the entrance is the industry standard for any commercial property.

Practical translation. Commercial NY camera installs default to video-only on the cameras and route audio capture through a separate documented intercom or call-recording workflow. Audio in a NY camera install is fine if you can document one-party consent, but most operators simplify the picture by keeping audio off the cameras entirely.

Biometric data law

New York coverage of biometric data is layered, not consolidated.

  • NYC commercial establishments. NYC Admin Code 22-1201 through 22-1205 (effective July 2021) requires posted notice at every customer entrance for any commercial establishment that collects biometric identifier information from customers. The law prohibits selling or sharing biometric data and creates a private right of action.
  • NYC residential. NYC Local Law 3 of 2021 restricts use of biometric recognition technology at residential buildings.
  • NY State data security. The SHIELD Act (NY GBL 899-bb) reaches biometric data as part of "private information" requiring reasonable safeguards.
  • NY State employment. NY Labor Law provisions touch employee biometric capture indirectly through workplace privacy and wage notice requirements.

A statewide BIPA-style bill has been introduced in recent NY legislative sessions and remains in process as of 2026. Operators using fingerprint or facial recognition in NY should document consent, retention, and access controls now so they're ready for either an existing-law enforcement question or future statewide enactment.

Privacy in the workplace

NY Civil Rights Law 52-c (effective May 7, 2022) requires private employers in NY to provide written notice to employees of any electronic monitoring of telephone, email, or internet usage. The notice must be given upon hire, must be acknowledged in writing or electronically by the employee, and must be posted in a conspicuous location. Penalties run up to $500 for a first offense, $1,000 for a second, and $3,000 for each subsequent violation, assessed by the NY Attorney General.

Pure video surveillance of common work areas is not a literal target of 52-c, but most NY employers fold cameras, badge access, and call recording into one combined surveillance notice in the employee handbook. The single-notice approach is cheaper than litigating the boundary.

Cameras in employee-only spaces with a reasonable expectation of privacy (changing areas, lactation rooms, employee restrooms) are off-limits. Cameras in production lines, retail floor, loading docks, and warehouse aisles are routine when paired with notice.

Public-place and common-area cameras

For commercial real estate, multi-tenant residential, retail, and hospitality, the practical rule set is consistent. Cameras in lobbies, hallways, exterior, parking, retail floor, and other non-private common areas are lawful with posted notice. Cameras in bathrooms, fitting rooms, hotel guest rooms, and any other space where privacy is expected are off-limits.

NYC retail and hospitality operators using any biometric capture (entry-by-face, age verification by face) post the NYC 22-1201 notice at every customer entrance. NYC residential operators check Local Law 3 of 2021 before deploying biometric access control. Multi-borough operators tend to standardize on a single posted-notice template and a documented retention policy across the footprint.

Video retention requirements

NY State has no single statewide video retention statute that applies to all commercial cameras. Retention is set by the regime that governs the industry.

  • Cannabis. The NY Office of Cannabis Management (OCM) publishes camera coverage and retention rules. Pull the current OCM rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility, longer when an investigation is open.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Banks and financial institutions. NY Department of Financial Services 23 NYCRR 500 (the DFS cybersecurity regulation) imposes physical-safeguard expectations alongside its cyber requirements. Federal banking regulators also examine surveillance and retention.
  • Schools. FERPA reach for K-12 districts and higher education. NYS Education Department guidance applies to surveillance in schools.
  • Federal contractors and grantees. NDAA Section 889 controls vendor selection. Retention is contractor-driven through the SSP or grant award terms.

Default retention for NY commercial systems with no specific industry rule is 30 days. Operators in higher-risk industries set longer retention with explicit written retention policies in the WISP, facility security plan, or DFS-required documentation.

Notable enforcement examples

NY enforcement against businesses for camera and privacy issues runs through several channels. The NY Attorney General has brought SHIELD Act enforcement actions and consumer protection cases against businesses with documented data security and physical-control failures. NYC Department of Consumer and Worker Protection has enforced the 22-1201 biometric identifier notice requirement against retail and hospitality establishments since the law took effect. NY DFS has assessed cybersecurity-rule penalties against regulated financial institutions, with physical safeguards part of the assessment in some matters.

Federal HIPAA settlements have reached NY-based defendants where physical safeguards (facility access control, camera coverage of PHI areas) were a documented part of the breach. PCI assessor findings have triggered card brand penalties at NY retailers where camera coverage of the cardholder data environment was inadequate or retention was below 90 days. Real settlements are published on the NY AG, NYC DCWP, NY DFS, and HHS OCR enforcement pages.

What Tec-Tel does to comply with NY regulations

Tec-Tel installs across New York for retail, manufacturing, healthcare, multi-tenant residential, financial, and licensed cannabis customers. The default install pattern for a NY commercial site:

  • Video-only on cameras unless audio is documented with one-party consent.
  • Posted surveillance notice at every public entrance. NYC commercial sites collecting biometric data add the 22-1201 notice at every customer entrance.
  • No cameras in restrooms, locker rooms, fitting rooms, hotel guest rooms, or other spaces with a reasonable expectation of privacy.
  • Civil Rights Law 52-c hire-time written notice template added to the install package for employer customers.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, OCM, DFS 500, NDAA), with the facility's written retention policy attached.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state, NYC, and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific NY regulatory question, work with your privacy counsel.

Security service in New York

Tec-Tel deploys AI-era security across New York with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.