Regulations › US states › New Jersey
NJDPA
New Jersey Data Privacy Act
WhenIn effect since 15 January 2025
Who enforces itNew Jersey Attorney General (Division of Consumer Affairs)
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds100,000 consumers, or 25,000 consumers plus any revenue or discount from selling personal data
Universal opt-outMust honor user-selected universal opt-out mechanisms such as GPC from July 15, 2025
Cure period30-day cure notice required until July 1, 2026 (18 months after effect)
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $10,000 for a first violation and $20,000 for later violations under the Consumer Fraud…
Private actionNo private right of action
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws