Comprehensive state privacy law
New Jersey privacy law
New Jersey Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- N.J.S.A. 56:8-166.4 to 56:8-166.19 (P.L.2023, c.266), with N.J.S.A. 56:8-166.20 to 56:8-166.24 (P.L.2026, c.25)
- Enacted
- January 16, 2024. P.L.2023, c.266 (Senate Bill No. 332, sixth reprint), approved 16 January 2024
- In force
- January 15, 2025
- Effective dates
- January 15, 2025: main provisions (the act takes effect on the 365th day after enactment, section 17)
- July 15, 2025: duty to honour a user-selected universal opt-out mechanism for targeted advertising and sale (not later than six months after the effective date, C.56:8-166.11(b)(1))
- June 30, 2026: ban on selling sensitive data and new data broker and data collector rules (P.L.2026, c.25, effective immediately)
- March 27, 2027: public data broker and data collector registry provision becomes operative (subsection b. of section 2 of P.L.2026, c.25 is inoperative for 270 days after enactment)
- Enforcer
- Attorney General (sole and exclusive authority), acting through the Division of Consumer Affairs; violations are unlawful practices under the Consumer Fraud Act
- Private right of action
- No. The Act gives no basis for a private right of action for its violations (C.56:8-166.19).
- Cure period
- 30 days. Ended July 1, 2026. Until the first day of the 18th month after the effective date, the Division had to give notice before enforcement where it judged a cure possible, and could act only if the controller failed to cure within 30 days. Counting from the 15 January 2025 effective date, the 18th month begins on 1 July 2026, so the cure period has ended. Some sources give 15 July 2026; the statutory wording points to 1 July 2026. (C.56:8-166.17(b))
- Rulemaking
- Yes, Director of the Division of Consumer Affairs, Department of Law and Public Safety. The Director must adopt rules (C.56:8-166.18) and may set technical specifications for universal opt-out mechanisms (C.56:8-166.11(c)). Proposed rules (N.J.A.C. 13:45L, 57 N.J.R. 1101(a)) were published on 2 June 2025 with comments due 1 August 2025; the Attorney General said a Notice of Adoption was expected in 2026. No adoption notice was found. Secondary sources report that the proposal expired unadopted on 2 June 2026; this could not be confirmed on the Division's site, which blocked automated access. Treat the rules as not in force. Rules
Amendments
- P.L.2026, c.25 (Assembly Bill No. 5328, first reprint), approved 30 June 2026 (in force June 30, 2026). Adds to the controller duties a ban on selling sensitive data that applies to every person or entity regardless of the number of consumers (C.56:8-166.12(a)(6)); bars data brokers and data collectors from selling or licensing sensitive data (C.56:8-166.22); requires annual registration and fees for data brokers and data collectors with the Division of Consumer Affairs (C.56:8-166.20; the public registry provision is inoperative until 27 March 2027); sets a civil penalty of $50,000 for each record of sensitive data sold, offered for sale or licensed (C.56:8-166.23) and $2,500 a day for failure to register or report (C.56:8-166.21).
Topics
- ApplicabilityThe Act applies to controllers that do business in New Jersey or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers (not counting data used only to complete a payment), or of at least 25,000 consumers while earning any revenue or receiving any discount from selling personal data. There is no revenue-only test and no general exemption for nonprofits or higher education. GLBA financial institutions and their affiliates, insurance institutions, state agencies and political subdivisions are excluded, while HIPAA protected health information and FCRA-governed data are exempt at data level. People acting in a commercial or employment context are not consumers.
- Consumer rightsConsumers may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling that leads to legal or similarly significant decisions. Controllers must answer verified requests within 45 days, extendable once by 45 days with notice and reasons, and must offer an appeal decided within 45 days. If an appeal is denied, the controller must tell the consumer how to complain to the Division of Consumer Affairs. Opt-out requests need not be authenticated, and consumers may use an authorized agent, including a browser setting or global device setting.
- Sensitive dataSensitive data includes racial or ethnic origin, religious beliefs, health conditions or treatment, certain financial account information with access credentials, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, data of a known child, and precise geolocation within 1,750 feet. Controllers need consent before processing sensitive data, and must follow COPPA for children. Since 30 June 2026 no one may sell sensitive data at all, whatever their size, with a civil penalty of $50,000 per record. For consumers known to be 13 to 16 years old, controllers need consent for targeted advertising, sale or significant-effect profiling.
- Controller dutiesControllers must publish a privacy notice covering data categories, purposes, third-party categories, shared data, how to exercise and appeal rights, how material changes are notified, and a working contact email or online mechanism. They must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and run documented data protection assessments for targeted advertising, risky profiling, sale and sensitive data. Since 15 July 2025 they must honour a user-selected universal opt-out mechanism for targeted advertising and sale.
- ProcessorsProcessors must follow the controller's instructions and help it answer rights requests, meet security and breach duties, and carry out assessments. A binding contract must set out instructions, nature and purpose, data types, duration, and the parties' rights and obligations, and must require deletion or return of data, compliance information, and audits or an independent assessment. A processor that decides purposes and means on its own becomes a controller for that processing.
- EnforcementA violation is an unlawful practice under the Consumer Fraud Act, and the Office of the Attorney General has sole and exclusive enforcement authority. Until 1 July 2026, the Division of Consumer Affairs had to give a 30-day cure notice where it judged a cure possible; that period has ended. Consumer Fraud Act penalties apply (stated in an official legislative statement as up to $10,000 for a first offence and $20,000 for later offences), and selling sensitive data now carries $50,000 per record. There is no private right of action.
Sources
- P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19
- S332, sixth reprint (as amended by the General Assembly, 21 December 2023)
- P.L.2026, c.25 (A5328 1R), chapter law text
- Office of the Attorney General, release on proposed data privacy rules (2 June 2025)
- Assembly Bill 581 (2018), statement describing Consumer Fraud Act penalties under N.J.S.A. 56:8-13 (official legislative document, not codified text)
- Troutman Pepper, 'New Jersey's Proposed Data Privacy Regulations Have Expired' (June 2026), used only as a lead
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Jersey statute
Reference material, not legal advice.