From #MeToo to the Retail Worker Safety Act: The Real History Behind New York's Training Requirements

Every mandatory training requirement I write about eventually gets reduced to a citation and a deadline: which statute, how many hours, what date. That's useful, but it skips the part that actually explains why the rule is shaped the way it is. Four of the five requirements below are New York State laws, so they apply the same way whether your people work in Buffalo or Brooklyn. The fifth is a New York City law that adds its own layer on top, but only within the five boroughs. None of them came out of a committee working through a checklist. Each one was written in response to something specific: a movement, a data breach, workers who'd finally had enough. Knowing that history tends to make the compliance obligation click into place, including the parts that otherwise seem arbitrary.

This one walks through all five, in the order they were actually passed, and what each one means for you today.

2018: #MeToo Reaches Albany and City Hall

In late 2017, the Weinstein reporting broke and #MeToo went from a hashtag to a nationwide reckoning. New York answered fast, and it answered twice. The City Council passed the Stop Sexual Harassment in NYC Act on April 11, 2018, and the very next day, Governor Cuomo signed a package of state-level reforms as part of the FY2019 budget bill. Mayor de Blasio signed the city bill into law a few weeks later, on May 9.

Both packages did more than mandate training. New York State's reforms banned mandatory arbitration of harassment claims, restricted non-disclosure agreements in harassment settlements unless the person bringing the claim wanted confidentiality, and extended protection to independent contractors, not just employees. The training requirement, codified at Labor Law § 201-g, was one important piece of a larger effort to change how harassment claims got handled after the fact.

NYC's version did something structurally different, and in a way, more significant. Before this law, the city's own Human Rights Law only protected employees at companies with four or more employees. Smaller businesses were simply outside its reach. The Stop Sexual Harassment Act eliminated that threshold specifically for gender-based harassment claims, extending protection to every employee in the city regardless of employer size, so a two-person shop now carries the same underlying legal exposure as a large corporation. The training mandate itself, though, kept a higher bar: it only reaches employers with 15 or more employees.

What this means for you today: If you have people in New York State, Labor Law § 201-g requires annual, interactive harassment prevention training for every employee, regardless of company size, with separate content for supervisors and non-supervisors. If those people also work in New York City (or are based elsewhere but connected to the city in a real way, a nuance the city's own guidance doesn't limit to your local headcount alone) and your company has 15 or more employees, NYC's Local Law 96 adds its own annual training requirement on top of the state's, plus a fact sheet for new hires and a posted workplace notice.

2019: The Breach That Changed New York State's Data Laws

In September 2017, Equifax disclosed that hackers had accessed the personal data of roughly 147 million people nationwide, including more than 8 million New Yorkers: Social Security numbers, birth dates, addresses among them. The state's data breach law at the time only told companies what to do after something like that happened. It said nothing about what they had to do to prevent it in the first place.

The New York State Attorney General's office wrote the fix. Sponsored in the legislature by Senator Kevin Thomas and Assembly Member Michael DenDekker, the Stop Hacks and Improve Electronic Data Security Act, known as the SHIELD Act, was signed on July 25, 2019, just weeks after New York State and other states announced a $650 million multistate settlement with Equifax over the breach. Where the old law only punished companies after the fact, SHIELD requires them to have reasonable safeguards in place before anything happens.

What this actually requires: If your business holds the private information of New York State residents (and for most employers, that's already true the moment you have a single New York State employee on payroll, since a name paired with a Social Security number counts), the SHIELD Act (General Business Law § 899-bb) requires you to maintain a reasonable data security program. Training is explicitly one of the enumerated ways to satisfy that standard: training and managing employees in your security program's practices and procedures. There's no fixed curriculum or hour requirement the way there is for harassment training. What you do risk is real exposure if a breach happens and you can't show a security program, training included, was actually in place.

2021: What Essential Workers Won

By the spring of 2021, more than 51,000 New Yorkers had died in the COVID-19 pandemic, many of them essential workers who had no legal right to a safe workplace beyond general OSHA obligations that were never built for an airborne pandemic. A coalition of more than 75 unions, worker centers, and advocacy groups, organizing as the NY Essential Workers Coalition, spent months pushing the legislature to change that permanently, not just for COVID, but for whatever comes next.

Governor Cuomo signed the NY Health and Essential Rights Act on May 5, 2021. It was the first law in the country to create permanent, enforceable workplace safety standards specifically for airborne infectious disease, rather than a temporary emergency order that expires when the crisis does.

Where this lands for you: Every private New York State employer needs a written Airborne Infectious Disease Exposure Prevention Plan on file, all the time, whether or not any disease is currently circulating. That part isn't optional or conditional on anything. What is conditional is the training. The moment the state Commissioner of Health designates a disease as a serious airborne public health risk, the way it did with COVID-19, your plan activates, and full training becomes mandatory almost immediately: the disease itself, exposure risks at your specific worksite, employee rights under the Act. There's no ramp-up period built into the law, because the entire point of it was to make sure the state never again has to build these protections from scratch while people are already getting sick. Luckily, you don’t need to train employees on this today. But you need to be ready to do so if the Commissioner declares there is a serious airborne public health risk.

2024: Retail Workers Push Back

Retail work has always carried a different kind of risk than an office job, but the pandemic sharpened it. Retail employees became the ones enforcing mask mandates and capacity limits with customers who didn't want to comply, and a lot of them say the hostility never fully went away once those mandates lifted. The Retail, Wholesale and Department Store Union spent years organizing around it, and the bill's own legislative justification memo put it plainly: retail workers face constant verbal harassment, threats, and actual violence, and "violence has become normalized in retail settings."

Governor Hochul signed the Retail Worker Safety Act into law in September 2024, sponsored by Assembly Member Karines Reyes along with dozens of co-sponsors. It was amended in February 2025 to push the compliance deadline to June 2, 2025, and to carve out a separate, later requirement for silent panic buttons at the largest retailers.

In practice: If you're a retail employer with 10 or more employees, counted across your whole business rather than per location, New York Labor Law § 27-e requires you to adopt a written workplace violence prevention policy and provide interactive annual training covering de-escalation tactics, active shooter response, emergency procedures, and how to use whatever security devices your location has. New hires need it at onboarding; everyone needs it annually after that, and it has to be delivered in English and in each employee's primary language. If your business has 500 or more retail employees, there's a further requirement, physical silent response buttons throughout the workplace, but that one doesn't take effect until January 1, 2027.

Why the History Matters

Laying these out in order, none of them exist because a regulator wanted more paperwork on file. Each one answers something that had already gone wrong: harassment complaints that weren't being handled well, a data breach that showed how little proactive security the state actually required, a pandemic that left essential workers without real protection, and a few years of retail workers getting hurt with nobody doing much about it. What's usually left standing once a law like that gets written is the training requirement. That's also why the compliance work feels less arbitrary once you know the backstory, even when the deadlines and thresholds still take some getting used to.

For reference, all five in one place:

Four of these five apply no matter what industry you're in. The fifth, retail workplace violence prevention, is included here because it's recent, and because it's a clean example of something bigger than itself: everything above is just the floor. On top of it sits a whole layer of requirements that key off your specific industry (healthcare, education, hospitality, retail, and others each have their own), and another layer on top of that, which keys off the specific role an individual employee holds, regardless of what industry you're in. Retail workplace violence prevention happens to be an industry-level example. Plenty of others are role-level ones, and most employers never see them coming until an audit does.

For now, the practical challenge is the same one under any of the requirements above: knowing which ones actually apply to your business, keeping your plans and records current, and being ready to prove it if you're ever asked. That's exactly what EasyLlama's Compliance Advisor is built to help with. Tell it about your business, and it maps your locations, industry, and roles to what's actually required, explains why, and flags gaps before an audit does.

Talk to our team about Compliance Advisor →