California New York algorithm disclosures: the current gap

What to take away

What a practical algorithm disclosure looks like

A disclosure that satisfies both a consumer rights request and a proposed transparency duty has four parts. It names the signals, explains their role, identifies the data sources, and tells the user how to change the result. Everything else is detail.

A worked example, for a short video feed:

That structure works because each part maps to a legal duty. Signals and sources answer the right to know. Controls answer the opt out. The role description is what New York bills would add.

A checklist for the disclosure review:

Two traps recur. The first is describing the model instead of the ranking outcome, which produces a document no reader can use. The second is publishing a description that the product team cannot confirm, which turns a compliance document into evidence of a mismatch.

Finally, treat trend and ranking claims carefully. A disclosure that cites performance numbers should rest on data the platform can defend.

What the CCPA requires platforms to disclose about feed rankings

The California Consumer Privacy Act is the state's comprehensive consumer privacy statute. It applies to for-profit platforms doing business in California that meet one of three thresholds.

The thresholds are more than $25 million in annual gross revenue, or buying, selling or sharing personal information of 100,000 or more consumers or households. A third threshold is earning 50 percent or more of annual revenue from selling or sharing personal information. The statute itself does not use the phrase feed ranking.

It reaches feeds through the definition of personal information and through the right to know, which covers the categories of information a business collects and the purposes for which it uses them.

A feed is built from behavioral signals: what a user watches, pauses on, shares, hides or reports. Those signals are personal information when they are linked to a consumer or household. A platform that ranks posts using that data has to be able to describe the categories it uses and the business purposes behind them.

The official CCPA page maintained by the California Department of Justice sets out the consumer rights that generate these duties. They are the right to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. For feed ranking, the right to know and the opt-out right do the most work.

The opt-out right matters because feed ranking often depends on sharing personal information for cross-context behavioral advertising. California treats that sharing as a form of sale in many cases, so the platform must offer a clear opt-out and honor it. That changes the ranking inputs for a user who opts out.

Regulations adopted under the CCPA add detail on notices, purpose limitation and the annual review of a business's data practices. They require notices at collection to state the categories collected and the purposes, which is where a platform's feed signals should appear. The same rules cover retention periods and service provider contracts.

The California Privacy Protection Agency is responsible for the implementation and administrative enforcement of the CCPA and its implementing regulations, while the Attorney General's office brings its own enforcement actions.

California's privacy work sits inside a broader data security and privacy enforcement program at the Department of Justice. That program covers consumer protection statutes alongside the CCPA, and it shapes how the office prioritizes platform investigations. Readers tracking state privacy law should treat the two as one enforcement environment.

One limit deserves emphasis. The CCPA gives consumers rights over personal information, not a general right to see a ranking formula. A platform can describe categories and purposes without publishing weights or model code. That gap is exactly what New York's proposed algorithm transparency bills aim to close.

For platforms, the practical CCPA feed ranking disclosure has three layers. There is a short collection notice at the point of use, a fuller privacy policy section on ranking, and a request response naming the categories of personal information used to personalize content.

New York's approach to ranking disclosures

New York has not enacted a comprehensive consumer privacy statute comparable to the CCPA. Its algorithm transparency bills are separate proposals that target recommendation systems directly. Because they are bills, their text, sponsors and status change from session to session.

In the 2023-2024 session, Senator Andrew Gounardes sponsored the SAFE for Kids Act (S7694A) and the Child Data Protection Act (S7695A). Those laws target minors' data and addictive feeds. They do not require the general ranking disclosures described here. General algorithm transparency bills that would require published ranking descriptions remain pending.

The closest enacted New York disclosure rule covers moderation rather than ranking. In an October 2, 2025 announcement, Attorney General Letitia James said social media companies must start reporting their content moderation policies to her office under the Stop Hiding Hate Act, sponsored by Senator Brad Hoylman-Sigal and Assemblymember Grace Lee and signed by Governor Hochul. The law requires platforms to submit biannual reports on whether and how their existing policies deal with hate speech, racism, misinformation and other types of content. It says nothing about ranking signals or feed design, which is the gap the pending algorithm bills target.

A typical New York proposal would require a platform that uses a recommendation algorithm to publish a readable description of how the system ranks content. The description would cover the main ranking signals, whether the user can adjust them, and whether the platform uses data from outside its own service.

The bills also commonly address minors. Versions filed in recent sessions would require an algorithmic risk assessment for users known to be under eighteen, plus a duty to reduce exposure to content linked to harmful outcomes. Those provisions go beyond anything in the CCPA.

Some versions include an audit or reporting duty, with findings filed with a state agency and summarized publicly. Others rely on a private right of action, letting users sue over violations. The choice between agency filing and private suits is the main fault line in the debate.

New York's role as a media and advertising hub shapes the argument. Agencies, publishers and ad tech firms in New York City watch ranking changes closely because feed placement drives campaign performance. The state legislature hears from that industry alongside civil rights and child safety groups.

Enforcement would fall to the New York Attorney General for versions with a public enforcement mechanism. State attorneys general generally hold consumer protection authority over unfair or deceptive practices, which is a separate track from privacy statutes. That authority is the fallback if a bill stalls.

The practical effect for platforms is preparation cost. A New York-style disclosure duty requires documentation of ranking signals that most platforms keep in engineering teams, not in legal or policy functions. Building that inventory before a bill passes is cheaper than building it under a deadline.

Comparing disclosure duties across California and New York

The two states regulate the same subject from different directions. California regulates personal information and lets consumers pull answers out of platforms. New York's proposals would regulate the ranking system itself and push descriptions out to the public. A platform can comply with one and still fail the other.

That difference drives every planning decision below.

A useful way to read the table is by audience. California answers a user who asks what data drives their feed. New York would answer a reader who asks how the ranking system works in general. The first is individualized and the second is systemic.

The systemic approach raises hard questions about trade protection and abuse. Platforms argue that publishing ranking signals invites manipulation, and legislators counter that opacity hides discrimination and amplification harms. Any final New York text will reflect that negotiation.

Compliance deadlines platforms are working toward

California deadlines are already in force. The CCPA took effect on January 1, 2020, and the Attorney General began enforcement on July 1, 2020. Later amendments added rights and moved deadlines for related obligations, including the sensitive information limits and the opt-out preference signal.

The practical California timeline is annual. Notices must be updated when data practices change, and the regulations require a review of the business's data processing at least once every twelve months. Platforms that add ranking signals or new data sources should treat that as a trigger to refresh notices.

New York has no compliance date yet because no bill has been enacted. The filed versions use the standard New York effective-date clause, often 'on the first of January next succeeding the date on which it shall have become a law.' Some versions add a later compliance trigger.

Steps five and six are where most platforms are weakest. Minors assessments need data on age signals and content exposure, and review cycles fail when no one owns the calendar. A named owner with a quarterly check is enough to start.

Enforcement examples from the California Attorney General

The Attorney General's office has used the CCPA to bring actions over failures that sound narrow but matter for feeds. In 2022 the office settled with Sephora for $1.2 million over failures in its sale opt-out and notice. In 2024 it settled with DoorDash for $375,000 over a marketing cooperative that shared personal information without a working opt-out.

The office publishes its actions and consumer alerts through its press releases, which is where platforms should look for the current enforcement posture rather than relying on summaries. Reading the complaints shows the specific notice language and link placement the state expects.

A recurring theme is that the opt-out must be easy to find and must work. When a platform shares personal information for behavioral advertising, the state treats a buried or nonfunctional opt-out as a violation. Since that sharing feeds ranking, the fix touches the recommendation stack, not just the website footer.

The office has also pursued cases involving minors and sensitive data outside the CCPA, using consumer protection authority. That combination is the model New York could follow if its bills stall, and it is why platforms should not treat pending bills as the only risk.

The broader privacy and data security program at the Department of Justice shows how these actions fit together, including settlements and guidance that apply across industries. Platforms are not the only targets, but they are visible ones.

A state by state index of statutes is a fast way to check what applies where.

Enforcement context also comes from the state attorneys general directory, which shows which office handles consumer protection complaints in each state.

Two lessons carry over to any New York disclosure duty. First, the description must match what the system actually does, because a mismatch is the violation. Second, the user control must function, because a decorative setting is worse than none.

Common questions