A Real Grievance, an Overbroad Fix
News publishers have a legitimate complaint. Automated crawlers — many run by AI companies training models or powering "answer engine" products — hit news sites at volumes that strain servers, often while disguising themselves as ordinary browsers to dodge robots.txt exclusions or paywalls, and rarely send referral traffic back in return. News/Media Alliance president Danielle Coffey put the industry's case plainly: "news websites are drowning in bot traffic" from bots that are "disguising their identities to overload publisher servers and access the quality content" (News/Media Alliance). That is a genuine operational and economic problem, and it is fair for publishers to want crawlers to say who they are.
The New York legislature's answer, however, is a broad identity-disclosure mandate backed by steep, strict-liability-style penalties — and it just landed on Governor Kathy Hochul's desk.
What S9934A Actually Does
The Stealth Crawler Prohibition Act (S9934A/A11292), sponsored by state Sen. Michael Gianaris and Assemblymember Steven Otis, cleared the Senate 60–1 on June 2, 2026 (only Sen. Mark Walczyk voted no) and the Assembly on June 5, 2026, before being delivered to the governor (NY Senate bill page). It requires any crawler accessing a "covered news source" — a site with a public-information function, substantial content investment, monthly updates, and at least 1,000 monthly active New York users — to identify itself via "a valid and accurate user-agent string" naming the software, version and company behind it, and to disclose the "specific nature and purpose" of its access, including, per the bill text, "all uses and purposes that the content of the covered news source could be used for."
Crawlers that skip this and go on to "damage, impair or burden" a covered site's operation, or cause it economic harm, become "stealth crawlers" subject to enforcement on two tracks: the state Attorney General can seek injunctions and civil penalties of up to $15,000 per day per violation, and — notably — no proof of injury to any specific person is required for a court to find a violation. Separately, publishers get a private right of action and the power to obtain pre-litigation subpoenas compelling service providers to unmask the operators behind unidentified traffic.
The Coalition's Case for a Veto
On August 3, 2026, EFF and 18 other civil society organizations wrote to Hochul urging a veto, arguing the bill "harms free expression and establishes a dangerous precedent by effectively deanonymizing and criminalizing automated access to the open web" (EFF). Their objection isn't really about AI training scrapers — it's about what else the definition of "crawler" sweeps in. Investigative journalism has long relied on automated, sometimes anonymous, data collection: EFF points to The Markup's reporting on Amazon's search algorithm and ProPublica's work on Amazon pricing as examples of research that depended on tools functionally identical to what this bill would force to self-identify or face liability. Security researchers scanning for vulnerabilities, academics studying misinformation, and privacy tools that audit trackers — EFF's own Privacy Badger among them — all rely on the same category of automated access the bill defines as suspect by default.
Why the Disclosure Standard Overshoots
The practical difficulty is the "all uses and purposes that the content could be used for" language. A publisher-transparency requirement — name your company, state your purpose — is a defensible, targeted response to deceptive scraping. A requirement to enumerate every conceivable downstream use of ingested content is not something any operator, AI company or researcher, can comply with in good faith; uses evolve after collection in ways that are impossible to fully predict at the point of access. Combined with a no-injury-required AG enforcement standard and a subpoena power aimed at unmasking rather than compensating, the bill functions less like a scraping-fee mechanism and more like a general anti-anonymity rule for the open web, enforced at $15,000 a day.
That is a different tool than the problem calls for. Site operators already have technical means to signal and enforce crawling terms — robots.txt, rate-limiting, Cloudflare's default AI-bot blocking, and a growing set of licensing deals between publishers and AI firms — that address unauthorized scraping without requiring every automated visitor to preemptively identify itself or risk civil liability with no showing of harm. A narrower statute — one that penalizes crawlers only for demonstrated evasion of a publisher's stated access terms, and that ties penalties to actual damages rather than a flat per-day AG fine triggered without injury — would capture the bad-faith scraping publishers are rightly angry about while leaving legitimate anonymous and pseudonymous automated research alone.
Governor Hochul should either veto S9934A or send it back for a narrower fix. First-in-the-nation status is not, by itself, a reason to sign a bill whose enforcement mechanism reaches well past the AI-scraping problem it was written to solve.