stonybrook.edu Privacy Notice | Stony Brook University

Website Privacy Notice

Effective Date: August 11, 2026

Stony Brook University (“Stony Brook,” “the University,” “we,” “us,” or “our”) is committed to protecting your privacy and ensuring a transparent online experience. This Website Privacy Notice (“Notice”) describes how we collect, use, share, and safeguard personal information across www.stonybrook.edu and other University-operated websites, web forms, and applications linking to this Notice (collectively, the “Sites”).

At A Glance

Purpose-Driven Collection: We collect personal information to process applications, conduct campus events, deliver academic services, and communicate with our community.
User Control: You can update your communication settings, modify your cookie preferences, or exercise privacy rights specific to your location at any time.

Student Education Records (FERPA Notice):

This Statement governs website privacy and does not cover student education records. Handling of student records under the Family Educational Rights and Privacy Act (FERPA) is detailed on our FERPA Information Page (https://www.stonybrook.edu/registrar/info/ferpa.html).

1. Information We Gather

We collect information through three primary channels:

A. Information You Choose to Provide

Depending on how you interact with the Sites, you may voluntarily submit information such as:

Contact Details: Name, email address, mailing address, and telephone number.
Academic & Demographic Details: Date of birth, academic background, intended major, employer, and job title.
Transactions & Inquiries: Payment card data, event/ticket registrations, form submissions, and text logs from our AI-powered web chat assistant.

Please note that providing personal information through our web forms is voluntary. If you choose not to provide any requested information, we may be unable to process your transaction, inquiry, or registration, but your access to general public web services will not be affected.

B. Information Collected Automatically

When you navigate the Sites, our systems and third-party service providers log technical data such as:

IP address and estimated general geographic region.
Device parameters, operating system, browser type, and language.
Referring/exit pages, specific content viewed, and session date/time stamps.

Automatically collected data is used in aggregate to secure and improve site operations and is not linked to your personal identity unless you also voluntarily provide us with information that directly identifies you.

C. Information from External Sources

We may receive prospective student data from college search and testing organizations, list vendors, authorized international recruitment partners, and the State University of New York (SUNY) system. Where we receive or purchase information from these sources—such as from SAT/ACT preparation companies or college search services—we use it only for the recruitment, outreach, and advertising purposes described in this Notice, and it remains subject to the same privacy protections, minimization practices, and opt-out rights described in Sections 2, 3, 4 and 7 below.

2. How We Use Your Information

We process personal information for legitimate academic, administrative, and operational goals, including:

Administrative Operations: Operating Site features, fulfilling purchases, hosting campus events, and responding to inquiries.
Student Recruitment & Alumni Outreach: Communicating with prospective applicants, delivering recruitment materials, and maintaining alumni engagement records.
System Security & Analytics: Preventing fraud, detecting security vulnerabilities, and analyzing web usage trends.
Digital Outreach & Retargeting: We partner with platforms like Google, Meta, and LinkedIn to deliver relevant Stony Brook content to prospective students, applicants, and alumni. Contact details are anonymized using irreversible cryptographic hashing so platforms cannot identify you directly, and we use server-to-server transfers where possible to limit device tracking. You may opt out of these advertising uses at any time as described in Section 4 and 7.
Personalization : Making our communications more relevant and less repetitive by tailoring the content and timing of email outreach based on limited information such as your estimated general geographic region, expressed interests, and prior interactions with the Sites — helping us send you more useful information and fewer unnecessary messages.

3. Sharing & Disclosure of Information

We share personal information within the parameters below:

Authorized Service Providers: Vendors operating under written agreements who process data on our behalf (e.g., web hosting, chat tools, analytics).
Advertising & Marketing Platforms: To reach prospective students, applicants, and alumni with relevant Stony Brook content and reduce irrelevant advertising, we work with trusted advertising and social media platforms such as Google, Meta, and LinkedIn. Where contact information is shared with these platforms for this purpose, we use privacy-protective methods such as one-way cryptographic hashing, and we limit the information shared to what is reasonably necessary. This may include information originally received or purchased from third-party organizations (e.g., testing or college search companies) as described in Section 1C. You may opt out of this use at any time as described in Section 4.
Institutional & State Systems: The State University of New York (SUNY) and government or reporting bodies (including college ranking publications).
International Recruitment Agencies: Official recruitment representatives acting on behalf of the University abroad.
Legal Compliance & Court Orders: Public authorities or litigants when mandated by law, regulation, subpoena, or legal process.

No Selling of Personal Data: We do not sell or exchange your personal information for financial compensation.

4. Cookies, Tracking & Your Choices

A. Cookie Usage & Preferences

Cookies, beacons, and tracking pixels help us optimize site navigation and measure ad performance. You may disable non-essential cookies via your browser options; however, doing so may impact certain site functionality. For more information on disabling cookies, please visit https://www.aboutcookies.org/how-to-manage-and-delete-cookies.

B. Targeted Advertising Opt-Out

To opt out of interest-based advertising from participating providers, visit:

Network Advertising Initiative (NAI) Opt-Out: https://thenai.org/how-to-opt-out/
Digital Advertising Alliance (DAA) Opt-Out: https://optout.aboutads.info/
Google Ads Settings: https://myadcenter.google.com/personalizationoff?sasb=true&ref=ad-settings.

You may opt-out of direct email advertising via the “unsubscribe” or “opt-out” options contained in the email messages.

5. Safeguards & Retention

Data Protection: We maintain administrative, physical, and technical safeguards designed to prevent unauthorized access, alteration, or disclosure of data. However, no internet-based system can be guaranteed 100% secure.
Data Retention: Personal information is retained only for as long as necessary to fulfill its collection purpose and in accordance with applicable New York State agency records retention schedules.

6. Notice to International Users

Notice for Visitors Outside the United States:

This section applies to individuals located outside the United States where jurisdiction-specific data protection laws apply.

General Principles & U.S. Transfer Notice

Stony Brook University is located in the United States. Personal data collected through the Sites is transferred to, processed, and stored in the U.S., where privacy standards may differ from your home jurisdiction. Please see below for additional information as required by certain jurisdiction-specific laws.

Jurisdiction-Specific Provisions

Legal Grounds for Processing: We process personal data based on: (1) your consent; (2) performance of a contract; (3) compliance with our legal obligations; (4) performance of a task in the public interest (such as our academic mission); or (5) our legitimate interests in operating and securing the University and the Sites.

Your Rights (Explained): You may have statutory rights designed to give you direct control over your personal data:

Right of Access: You can ask whether we hold or process your personal data and request a copy of that data along with details on how it is used, stored, and shared.
Right to Rectification (Correction): You can ask us to update, complete, or fix any inaccurate, incomplete, or outdated personal information we hold about you.
Right to Erasure ("Right to Be Forgotten"): You can ask us to permanently delete your personal data if it is no longer needed for its original purpose, or if you withdraw your consent (unless legal or statutory retention obligations require us to retain it).
Right to Object to Processing: You can object at any time to us processing your data based on "legitimate interests" (e.g., direct outreach, marketing, or web analytics). We must stop processing unless we can demonstrate compelling legal grounds that override your interests.
Right to Restrict Processing: You can ask us to temporarily "freeze" or limit how we use your data, for instance, while we verify its accuracy or investigate a formal objection you submitted.
Right to Data Portability: You can request a structured, commonly used, and machine-readable copy of the data you provided to us, or ask us to transfer it directly to another institution where technically feasible.
Right to Withdraw Consent: Where processing is based on your consent (such as opt-in marketing or non-essential cookies), you can withdraw that consent at any time without affecting prior lawful processing.

Supervisory Authorities: You have the right to lodge a complaint with your local EU Data Protection Authority, the UK Information Commissioner’s Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Legal Basis & Separate Consent: Your personal data is handled with consent or under statutory necessity. Where required by law, we obtain separate opt-in consent prior to engaging in cross-border transfers, handling sensitive information, or sharing data with third parties.

Your Rights (Explained): Under the Personal Information Protection Law (PIPL), you have specific statutory rights regarding your personal information:

Right to Know and Decide: You have the right to receive full transparency regarding how your data is handled and to limit or refuse specific processing activities.
Right of Access and Copy: You can request to view your personal data files and obtain a copy in a standard electronic format.
Right to Correction and Completion: You can ask us to correct inaccuracies or complete missing personal information without delay.
Right to Deletion: You can request the deletion of your personal data when processing goals are complete, when services end, or if you withdraw your consent.
Right to Request Data Transfer: You can ask us to transfer your personal data directly to a designated third party if statutory requirements set by national cyberspace authorities are satisfied.
Rights of Deceased Individuals' Relatives: Close relatives may exercise rights to access, copy, correct, or delete a deceased individual's personal data for their own legitimate interests, unless the deceased stated otherwise before death.

Minors Under 14: Information of minors under 14 is treated as sensitive personal data requiring verified parental or guardian consent.

Destruction Mechanics: Expired personal data is permanently destroyed without delay using degaussing or electronic overwriting.

Your Rights (Explained): Under the Personal Information Protection Act (PIPA), you may exercise the following rights:

Right to Access: You can request to inspect the personal data records maintained about you by the University.
Right to Correction and Deletion: You can request that inaccurate records be corrected or that your personal data be deleted when its retention period expires or purpose is fulfilled (unless statutory retention mandates apply).
Right to Request Suspension of Processing: You can request that we temporarily or permanently halt the processing of your personal information.

Recourse: Complaints may be reported to the Personal Information Protection Commission (PIPC) or the KISA Privacy Call Centre (Dial 118).

Your Rights (Data Principal Rights Explained): Under the Digital Personal Data Protection Act (DPDPA), you (as a "Data Principal") hold the following rights:

Right to Summary & Information (Access): You can request a summary of the personal data being processed about you, an explanation of the processing activities, and the identities of all third parties with whom your data has been shared.
Right to Correction, Completion & Updating: You can ask us to fix inaccurate data, fill in incomplete data fields, or update outdated records.
Right to Erasure: You can request the deletion of personal data that was collected with your consent, unless applicable law requires us to retain it.
Right to Withdraw Consent: You can withdraw your consent as easily as you gave it. Upon withdrawal, we must stop processing your personal data unless another lawful ground applies.
Right of Grievance Redressal: You have access to a readily available mechanism to register complaints with our Privacy Office. If unsatisfied with our response, you may escalate your grievance to the Data Protection Board of India (DPBI).
Right to Nominate: You have the right to nominate another individual to exercise your privacy rights on your behalf in the event of death or incapacity.

Children’s Data: Verifiable parental consent is mandatory for minors under 18. Behavioral tracking or targeted advertising directed at children is strictly prohibited.

Language Accessibility: Notice translations will be made available upon request.

7. How to Exercise Your Privacy Rights

To submit a privacy request or exercise rights to control your data or contact Stony Brook’s Chief Privacy Officer or Data Protection Officer, email privacy@stonybrook.edu specifying your country of residence and the exact nature of your request. Identity verification will be required.

Under New York State Technology Law § 206, you have the right to inspect, copy, and request corrections to any personal information collected about you through our Sites. Requests to inspect or correct website-collected information should be submitted in writing to the Privacy Office at privacy@stonybrook.edu.

8. Notice Updates & Contact Information

We may update this Notice periodically. Material updates will be reflected by the “Effective Date” at the top of this page.

Privacy Office
Stony Brook University
100 Nicolls Road,
Stony Brook, NY 11794, USA
Email: privacy@stonybrook.edu

Privacy Notice