--- title: "New Jersey privacy law (NJDPA): sensitive data" canonical: "https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data" source: "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- New Jersey Data Privacy Act # New Jersey privacy law (NJDPA): sensitive data Law as of October 28, 2026 ยท [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Sensitive data includes racial or ethnic origin, religious beliefs, health conditions or treatment, certain financial account information with access credentials, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, data of a known child, and precise geolocation within 1,750 feet. Controllers need consent before processing sensitive data, and must follow COPPA for children. Since 30 June 2026 no one may sell sensitive data at all, whatever their size, with a civil penalty of $50,000 per record. For consumers known to be 13 to 16 years old, controllers need consent for targeted advertising, sale or significant-effect profiling. ## Key points 1. Sensitive data covers race or ethnicity, religion, health, financial account data with access codes, sex life or orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, known child data and precise geolocation. Section: [C.56:8-166.4](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 2. Consent is required before processing sensitive data; for a known child, processing must follow COPPA. Section: [C.56:8-166.12(a)(4)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 3. Since 30 June 2026, sensitive data may not be sold, and this applies to everyone regardless of the number of consumers. Section: [C.56:8-166.12(a)(6)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 4. Data brokers and data collectors may not sell or license sensitive data to anyone. Section: [C.56:8-166.22(a)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 5. Selling, offering for sale or licensing sensitive data carries a civil penalty of $50,000 for each record. Section: [C.56:8-166.23](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 6. Consent is required for targeted advertising, sale or significant-effect profiling where the controller knows or wilfully disregards that the consumer is at least 13 and younger than 17. Section: [C.56:8-166.12(a)(8)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 7. Consent must be revocable as easily as it was given, and processing must stop within 15 days of revocation. Section: [C.56:8-166.12(a)(7)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) ## Sources - [P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) - [P.L.2026, c.25 (A5328 1R), chapter law text](https://pub.njleg.state.nj.us/Bills/2026/PL26/25_.HTM) [Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the New Jersey statute](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) Reference material, not legal advice. ## Other topics for New Jersey - [Applicability](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-jersey/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/new-jersey/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) / Sensitive data Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-jersey/consumer-rights) Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents