Here is the bill: https://docs.reclaimthenet.org/New-York-2025-S08102-Amended.pdf

Main points:

"Covered manufacturer" shall mean a manufacturer of an internet-enabled device, an operating system provider, or an application store.

Obligations for covered manufacturers.

1. Upon activation of an internet-enabled device after the effective date of this article, a covered manufacturer shall conduct age assurance to determine a user's age category at the point of such activation. For devices that were activated prior to the effective date of this article, however, such covered manufacturer shall conduct the age assurance described herein on or before such effective date.

Data security.

1. A covered manufacturer or covered developer shall delete all information collected for the purposes of this article after such purpose has been achieved, except where necessary for compliance with applicable provisions of law or regulation.

So it would be any device that connects to the internet, regardless of the reason such as connecting to a VPN.