--- title: "New Jersey privacy law (NJDPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/new-jersey/consumer-rights" source: "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- New Jersey Data Privacy Act # New Jersey privacy law (NJDPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling that leads to legal or similarly significant decisions. Controllers must answer verified requests within 45 days, extendable once by 45 days with notice and reasons, and must offer an appeal decided within 45 days. If an appeal is denied, the controller must tell the consumer how to complain to the Division of Consumer Affairs. Opt-out requests need not be authenticated, and consumers may use an authorized agent, including a browser setting or global device setting. ## Key points 1. Rights: confirm and access, correct, delete, portable copy, and opt out of targeted advertising, sale and significant-effect profiling. Section: [C.56:8-166.10(a)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 2. Response within 45 days of receipt; one extension of 45 days if the consumer is told within the first period. Section: [C.56:8-166.7(a)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 3. Responses are free once per consumer in any 12-month period; manifestly unfounded, excessive or repetitive requests may be charged or refused. Section: [C.56:8-166.7(d)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 4. Appeal process required; written decision within 45 days, with a route to complain to the Division of Consumer Affairs if denied. Section: [C.56:8-166.7(f)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 5. A controller need not authenticate an opt-out request but may refuse one it reasonably and in good faith believes, with documentation, to be fraudulent. Section: [C.56:8-166.7(e)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 6. A consumer may name an authorized agent to opt out, including through a website link, browser setting or global device setting. Section: [C.56:8-166.11(a)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 7. No new account may be required to exercise a right, and the controller may not raise prices or reduce service solely because a right was exercised. Section: [C.56:8-166.6(c)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) ## Sources - [P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the New Jersey statute](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) Reference material, not legal advice. ## Other topics for New Jersey - [Applicability](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/new-jersey/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents