Section 204. Collection and disclosure of personal information

No state
  agency shall collect personal information concerning a  user  through  a
  state agency website, or disclose personal information concerning a user
  to any person, firm, partnership, corporation, limited liability company
  or   other  entity,  including  internal  staff  who  do  not  need  the
  information in the performance of their official duties  pursuant  to  a
  state  agency  purpose  meeting  the  requirements of subdivision one of
  section two hundred six of this article, unless such user has  consented
  to  the  collection  or disclosure of such personal information. For the
  purposes  of  this  section,  the  voluntary  disclosure   of   personal
  information  to a state agency by a user through a state agency website,
  whether solicited  or  unsolicited,  shall  constitute  consent  to  the
  collection  or disclosure of the information by the state agency for the
  purposes for which the  user  disclosed  it  to  the  state  agency,  as
  reasonably ascertainable from the nature and terms of the disclosure.