New York City’s new Tenant Data Privacy Act (TDPA) is one of the first statutes in the U.S. to regulate collection and retention of data from multifamily buildings with IoT systems. It applies to systems with electronic or computerized technology, including radio frequency ID cards, key fobs, mobile phone access apps, and biometric systems used to grant entry. TDPA requires express consent from tenants for data collection, and prohibits use of data other than what it was collected for, or having information used to harass or evict a tenant. It goes into effect in 60 days. Buildings that go online for the first time now must comply by then, while existing smart-access buildings will be given an 18-month grace period.