79%
of New Jersey's 19 requirements are already met by California (CA). Here is what NJDPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
NJDPA adds3 Internal appeal decided within 45 days; denial must tell consumer how to contact the Division of Consumer Affairs.
P.L.2023, c.266, § 4 · source ↗
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
NJDPA adds2 Opt-in consent; categories include financial account data, transgender or non-binary status, sex life and health.
P.L.2023, c.266, §§ 1, 9 · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
NJDPA adds1 100,000 consumers, or 25,000 consumers plus any revenue or discount from selling personal data; payment-only data excluded.
P.L.2023, c.266, § 2 · source ↗
Maximum penaltyEnforcementGap
CA2 Up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16 (2025 adjusted).
NJDPA adds3 Up to $10,000 for a first violation and $20,000 for later violations under the Consumer Fraud Act.
P.L.2023, c.266, § 14; N.J.S.A. 56:8-13 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, De-identified data, Who enforces, Cure period, Private action, Rulemaking.
A gap means NJDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
