NYC’s Tenant Data Privacy Act: Rules for Key Fobs and Smart Locks

What NYC Local Law 63 requires of buildings with keyless entry: consent, the data that may be collected, 90-day deletion, no tracking and a privacy policy.

By Seayora Editorial Team · Published October 23, 2026 · Facts checked October 23, 2026 · 3 min read

Short answer: New York City’s Local Law 63 of 2021 applies to multiple dwellings that use keyless entry such as key fobs, phone apps, cards or biometrics. Owners must give tenants a data retention and privacy policy, obtain express consent before collecting reference data, collect only a listed minimum of data, destroy authentication data within 90 days unless it is anonymized, never sell it or track tenants outside the building, and never use the system to harass or evict a tenant.

Key takeaways

It covers smart access systems in class A multiple dwellings: fobs, cards, apps, biometrics and similar technology.
Express consent, in writing or through an app, is required before collecting a user’s reference data.
Only listed data may be collected, such as name, unit, the doors a user may open, credential identifiers and the time and method of access, for security.
Authentication data must be destroyed within 90 days of being collected or generated unless kept in anonymized form.
Owners may not sell the data, track location outside the building, require smart access to enter the apartment itself, or use the data to harass or evict.

Which buildings does the Tenant Data Privacy Act cover?

Multiple dwellings that use “smart access (keyless) systems, including but not limited to key fobs, electronic or computerized technology, radio frequency identification card, mobile phone application, biometric identifiers, or any other digital technology” to grant entry to a class A multiple dwelling, its common areas or an individual unit. Owners must give tenants a data retention and privacy policy, and the system “must have robust security and safeguards” (NYC Department of Housing Preservation and Development).

What data may an owner collect?

Only the minimum needed to make the system work: the user’s name; the unit number and the doors or common areas the user may open; the user’s preferred method of contact; biometric identifier information if the system uses it; the identifier of the card, fob or other hardware; passwords, passcodes and user names used to gain entry or manage the account; lease move-in and move-out dates; and “the time and method of access, solely for security purposes.” Reference data may be collected only with the user’s express consent, in writing or through a mobile application (HPD).

How long can access data be kept?

Owners and third parties “must destroy any authentication data collected from or generated by such smart access system in their possession no later than 90 days after such data has been collected or generated, except for authentication data that is retained in an anonymized format” (HPD). The local law also sets deadlines to remove a tenant’s reference data after they move out or withdraw consent (Local Law 63 of 2021).

What is prohibited?

Selling, leasing or disclosing the data, unless required by law or to the system’s operator with the tenant’s consent.
Using satellite navigation or similar technology to track a user’s location outside the building.
Using the data for any purpose other than granting access and monitoring entrances, exits and common areas; limiting when tenants may enter the building; or requiring smart access to enter a tenant’s own unit.
Using any information to harass or evict a tenant, to track how often and when a tenant comes and goes for that purpose, or to track the relationship status of tenants and guests.
Collecting reference data from someone who is not a tenant, or sharing data about a minor without a parent’s permission.

The law gives tenants a private right of action for an unlawful sale of data collected through the system (HPD).

What should an owner with keyless entry do?

Publish a plain-language privacy policy listing the data collected, who it is shared with and how it is protected.
Collect consent before enrolling a user, and keep the record.
Configure the system to delete or anonymize entry logs within 90 days.
Keep a physical key available for each apartment door.
Review vendor contracts for data sale, location tracking and retention terms.

Frequently asked questions

How long can a NYC landlord keep key fob entry logs?

Authentication data must be destroyed no later than 90 days after it is collected or generated, unless it is kept in an anonymized format.

Can a NYC building require tenants to use an app to enter their apartment?

No. The law bars using a smart access system to require its use to gain entry to the tenant’s own dwelling unit.

Can a landlord use fob data in an eviction case?

The law prohibits using information from the system to harass or evict a tenant, including tracking when and how often a tenant comes and goes for that purpose.

Sources

Tenant Data Privacy Law (Local Law 63 of 2021), NYC Department of Housing Preservation and Development
Int. 1760-2019, enacted as Local Law 63 of 2021, New York City Council

How Seayora helps

Data and privacy controls: See, export and delete what is held about an account, with the controls on each kind of data stated.

This article is general information, not legal advice. Landlord-tenant law varies by state and city and changes often, so check the current rule for your property and talk to an attorney before acting on a dispute.

How we write and check these guides: editorial standards.

Related on Seayora

Can a Tenant Sublet? Subletting Rules in New York, California and Texas — Guide. When a tenant may sublet: New York’s statutory right in buildings of four or more units, California’s reasonableness rule, and Texas’s consent requirement.
Security Cameras at Rental Properties: Placement and Audio Laws — Guide. Where landlords may and may not put cameras, why audio recording is the bigger legal risk, and the all-party consent rules in California and Washington.
Compliance Alerts & Required Filings — Feature. Seayora watches your properties for new violations and works out which recurring filings each building owes, turns both into a dated checklist, and emails you when something new appears. Live violation data for New York City; rule-based filing obligations across the NYC metro.
New Jersey Landlord-Tenant Law: Good Cause, Deposits and Notices — Guide. New Jersey rules for landlords: good cause under the Anti-Eviction Act, the 1.5-month deposit cap and 30-day return, Truth in Renting and flood notices.
Data Privacy & Portability — Feature. Privacy controls, GLBA financial privacy handling, data export, and account deletion — plus encryption in transit and hardened infrastructure.
Data Export & Account Deletion — Documentation. How to export your data before closing your account, how to delete the account yourself from any device, and exactly what Seayora keeps afterwards and why.