DPO SchoolDPO School

New Jersey Data Privacy Act

New Jersey privacy law (NJDPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data includes racial or ethnic origin, religious beliefs, health conditions or treatment, certain financial account information with access credentials, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, data of a known child, and precise geolocation within 1,750 feet. Controllers need consent before processing sensitive data, and must follow COPPA for children. Since 30 June 2026 no one may sell sensitive data at all, whatever their size, with a civil penalty of $50,000 per record. For consumers known to be 13 to 16 years old, controllers need consent for targeted advertising, sale or significant-effect profiling.

Key points

  1. Sensitive data covers race or ethnicity, religion, health, financial account data with access codes, sex life or orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, known child data and precise geolocation.

    Section: C.56:8-166.4

  2. Consent is required before processing sensitive data; for a known child, processing must follow COPPA.

    Section: C.56:8-166.12(a)(4)

  3. Since 30 June 2026, sensitive data may not be sold, and this applies to everyone regardless of the number of consumers.

    Section: C.56:8-166.12(a)(6)

  4. Data brokers and data collectors may not sell or license sensitive data to anyone.

    Section: C.56:8-166.22(a)

  5. Selling, offering for sale or licensing sensitive data carries a civil penalty of $50,000 for each record.

    Section: C.56:8-166.23

  6. Consent is required for targeted advertising, sale or significant-effect profiling where the controller knows or wilfully disregards that the consumer is at least 13 and younger than 17.

    Section: C.56:8-166.12(a)(8)

  7. Consent must be revocable as easily as it was given, and processing must stop within 15 days of revocation.

    Section: C.56:8-166.12(a)(7)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the New Jersey statute

Reference material, not legal advice.