DPO SchoolDPO School

New Jersey Data Privacy Act

New Jersey privacy law (NJDPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling that leads to legal or similarly significant decisions. Controllers must answer verified requests within 45 days, extendable once by 45 days with notice and reasons, and must offer an appeal decided within 45 days. If an appeal is denied, the controller must tell the consumer how to complain to the Division of Consumer Affairs. Opt-out requests need not be authenticated, and consumers may use an authorized agent, including a browser setting or global device setting.

Key points

  1. Rights: confirm and access, correct, delete, portable copy, and opt out of targeted advertising, sale and significant-effect profiling.

    Section: C.56:8-166.10(a)

  2. Response within 45 days of receipt; one extension of 45 days if the consumer is told within the first period.

    Section: C.56:8-166.7(a)

  3. Responses are free once per consumer in any 12-month period; manifestly unfounded, excessive or repetitive requests may be charged or refused.

    Section: C.56:8-166.7(d)

  4. Appeal process required; written decision within 45 days, with a route to complain to the Division of Consumer Affairs if denied.

    Section: C.56:8-166.7(f)

  5. A controller need not authenticate an opt-out request but may refuse one it reasonably and in good faith believes, with documentation, to be fraudulent.

    Section: C.56:8-166.7(e)

  6. A consumer may name an authorized agent to opt out, including through a website link, browser setting or global device setting.

    Section: C.56:8-166.11(a)

  7. No new account may be required to exercise a right, and the controller may not raise prices or reduce service solely because a right was exercised.

    Section: C.56:8-166.6(c)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the New Jersey statute

Reference material, not legal advice.