17JUN

New York forces AI crawlers to sign in

2 min read

09:26UTC

The New York State Assembly passed bill A11292 on 5 June requiring AI web crawlers to disclose their identity or face penalties of $15,000 a day.

← Back to Fox buys Roku's data layer for $22bn Jump to analysis ↓

IndustryDeveloping

Key takeaway

New York's A11292 forces AI crawlers to identify themselves, the precondition that makes billing and opt-out enforceable.

The New York State Assembly, the lower house of the state legislature, passed bill A11292 on Friday 5 June requiring AI web crawlers, the automated programs that copy site content to train models, to disclose their identity or face penalties of $15,000 a day ¹. The bill addresses the enforcement gap that every billing and opt-out scheme runs into: a crawler that masks itself, rotates IP addresses or poses as an ordinary browser cannot be invoiced, blocked or named in a filing.

A per-article charge collapses if the publisher cannot prove which company's crawler took the article, so identification has to come first. The UK Competition and Markets Authority ordered Google to build publisher opt-out tools earlier in June, part of the same publisher-AI economics fight News Corp's Anthropic settlement opened , but an opt-out only binds a crawler willing to declare what it is. New York attacks the masking directly, attaching a daily penalty large enough to make disguise expensive rather than free.

The $15,000-a-day figure is structured as a recurring liability, not a one-off fine, so the cost compounds for as long as a crawler stays anonymous. That design choice matters more than the headline number. A single penalty is a cost of doing business; a daily one is a clock the operator has to stop. New York's bill is narrower than a licensing scheme and does not set a price for content, yet it supplies the missing identity layer that turns the other measures from aspiration into something a court can act on.

Deep Analysis

In plain English

Automated programs called AI crawlers scan the internet to gather content for training AI systems or to answer questions in real time. These crawlers are supposed to identify themselves in the technical headers they send when visiting websites, but there is no legal requirement to do so and no penalty for lying about identity. On 5 June, New York State's lower legislature passed a bill (A11292) that would change this in New York: AI crawlers operating in the state would have to identify themselves truthfully, or face fines of $15,000 per day. The bill still needs to pass the New York Senate and be signed by the Governor before it becomes law. The relevance: publishers cannot charge or block a crawler they cannot identify.

Deep Analysis

Root Causes

AI crawlers currently operate in a legal identification gap: robots.txt convention requires crawlers to identify themselves in HTTP headers, but there is no statutory obligation to do so in US law, and no penalty for misrepresentation. Publishers relying on the MOW Search-Only Contracts scheme (see event 2 in this briefing) cannot invoice a crawler they cannot identify, making crawler identification the foundational precondition for any per-article billing or opt-out mechanism to work.

A11292 addresses that gap directly: mandatory identification with $15,000-per-day penalties converts crawler transparency from a voluntary technical convention to an enforceable legal obligation in New York State.

What could happen next?

Consequence
If A11292 becomes law and survives constitutional challenge, AI operators will need state-specific crawler identification for New York traffic, or face daily penalties that accrue faster than any per-article licensing cost.
Precedent
A11292's $15,000-per-day penalty structure is the first US statutory penalty for AI-crawler non-disclosure; it provides a legislative template for other state assemblies and potentially federal legislation.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: California's 2004 Online Privacy Protection Act (CalOPPA) required websites to post a privacy policy disclosing data collection practices. It was the first US state privacy law of its kind and applied nationally because companies found it impractical to maintain state-specific website versions.

A11292 follows the same pattern: New York State legislation that, if enacted into law and survived constitutional challenge, would effectively impose a national AI-crawler disclosure standard because operators cannot serve New York without compliance.

Counter-parallel: Illinois's 2008 Biometric Information Privacy Act (BIPA) required disclosure and consent for biometric data collection; its $15,000-per-day penalty structure for wilful violations is directly structurally similar to A11292's $15,000-per-day non-disclosure penalty.

BIPA generated the largest class-action settlements in privacy law history (Facebook at $650m, Google at $100m) but took 14 years to produce significant enforcement. A11292's disclosure requirement is simpler to prove but faces the same multi-year enforcement lag.

Sources:Press Gazette

Mentions:Google →Competition and Markets Authority →News Corp →New York State →Illinois →California →Anthropic →A11292 →

First Reported In

Update #6 · Fox buys Roku's data layer for $22bn

Press Gazette· 17 Jun 2026

Read original →

Different Perspectives

Italian market: Fastweb signed, Mediaset and RAI did not

Fastweb, the Italian broadband operator, signed Section 2 as a deployer, while Mediaset and the state broadcaster RAI are both absent. Italy therefore shows the split in miniature: a telecommunications company with one obvious deployment surface accepted the standard, and the two companies that actually broadcast to Italian audiences did not.

Paramount Skydance and its French exposure

Paramount filed a stipulation not to close on 24 July and had trial specialists admitted three days later, after nine months arguing that antitrust risk was regulatory rather than judicial. Its 22 July European clearance obliges it to divest a stake in the Universal International Pictures distribution venture and to strike no Universal distribution deal in Europe for a decade.

Time and the agent-advertising camp

Time and Mobian treat AI agent traffic as sellable inventory rather than leakage, on a site where bots now outnumber humans most days. Chief operating officer Mark Howard frames agent impressions as an extension of sponsorship, against an industry consensus still pursuing compensation for scraping.

German broadcasters

ARD, ZDF, RTL and ProSiebenSat.1 are all absent from the list, making Germany the largest single national bloc of non-signatories. Their position rests on three defensible grounds: signature is voluntary, most deployed systems are grandfathered to 2 December 2026, and a broadcaster's compliance surface spans production, archive, advertising and distribution rather than one product. None has publicly explained the decision.

Synthesia and the signed vendor layer

Synthesia signed Section 1 alongside Getty Images, Google, Meta, Microsoft, Anthropic, OpenAI, Mistral and Aleph Alpha, accepting a documented marking standard for the product they sell. London-headquartered Synthesia is the only pure AI-video vendor on the providers list, and gains a compliance artefact to put in front of European media buyers at the moment those buyers acquire a live obligation.

European Commission

The Commission published its initial signatory list on 31 July with roughly 190 organisations and let Article 50 take effect on 2 August as scheduled. Its own page stresses that adherence to the Code is voluntary while the transparency requirements are legal obligations, which frames non-signature as an evidentiary choice rather than a breach.