Regulations › US states › New Jersey
NJDPA
New Jersey Data Privacy Act
WhenIn effect since 15 January 2025
Who enforces itNew Jersey Attorney General (Division of Consumer Affairs)
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds100,000 consumers, or 25,000 consumers plus any revenue or discount from selling personal data
Universal opt-outMust honor user-selected universal opt-out mechanisms such as GPC from July 15, 2025
Cure period30-day cure notice required until July 1, 2026 (18 months after effect)
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $10,000 for a first violation and $20,000 for later violations under the Consumer Fraud…
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
100,000 consumers, or 25,000 consumers plus any revenue or discount from selling personal data; payment-only data excluded.P.L.2023, c.266, § 2 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified. No revenue-share minimum, so lower than standard 25k test.
Exemptions
2
GLBA financial institutions and insurers exempt; HIPAA PHI exempt only at data level; nonprofits are covered.P.L.2023, c.266, § 10 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Sensitive data and minors
Sensitive data
2
Opt-in consent; categories include financial account data, transgender or non-binary status, sex life and health.P.L.2023, c.266, §§ 1, 9 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Children and teens
2
Ages 13 to 16 (under 17): consent required for targeted ads, sale or profiling; under 13 follows COPPA as sensitive data.P.L.2023, c.266, § 9 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Data minimization
1
Collection adequate, relevant and reasonably necessary for disclosed purposes.P.L.2023, c.266, § 9 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Consumers' rights
Rights
2
Access, correct, delete, portability, opt out of targeted ads, sale and significant profiling (7 rights).P.L.2023, c.266, § 7 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Request deadline
2
45 days, extendable once by 45 days with notice.P.L.2023, c.266, § 4 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Appeals
3
Internal appeal decided within 45 days; denial must tell consumer how to contact the Division of Consumer Affairs.P.L.2023, c.266, § 4 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Universal opt-out
2
Must honor user-selected universal opt-out mechanisms such as GPC from July 15, 2025.P.L.2023, c.266, § 8 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Business duties
Assessments
2
Assessment before heightened-risk processing (targeted ads, risky profiling, sale, sensitive data); provided to the Division on request.P.L.2023, c.266, § 9 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Processor contracts
2
Contract terms, confidentiality, deletion, compliance information, assessments or annual independent audit, and written subcontractor flow-down.P.L.2023, c.266, § 13 · source ↗
No subcontractor notice or objection right. Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Privacy notice
1
Notice of categories, purposes, third-party categories, rights and appeal, contact; clear sale, targeted ads and profiling disclosure with opt-out.P.L.2023, c.266, § 3 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Loyalty programs
2
Loyalty and discount programs allowed only if the controller clearly discloses that they involve sale or processing the consumer can opt out of.P.L.2023, c.266, §§ 4-5 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
De-identified data
2
Deidentified data requires reasonable measures, a public commitment, and contract limits on recipients. No pseudonymous data rules.P.L.2023, c.266, §§ 1, 11 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Enforcement
Who enforces
2
Attorney General enforces under the Consumer Fraud Act; Division of Consumer Affairs must issue rules.P.L.2023, c.266, §§ 14-16 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Cure period
1
30-day cure notice required until July 1, 2026 (18 months after effect); now expired.P.L.2023, c.266, § 14 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Maximum penalty
3
Up to $10,000 for a first violation and $20,000 for later violations under the Consumer Fraud Act.P.L.2023, c.266, § 14; N.J.S.A. 56:8-13 · source ↗
Amounts from AG/Division FAQ; N.J.S.A. 56:8-13 cite not read directly.
Private action
0
No private right of action.P.L.2023, c.266, § 16 · source ↗
Cited by P.L.2023, c.266 bill section (S332 sixth reprint); codified at N.J.S.A. 56:8-166.4 et seq., exact section mapping not verified.
Rulemaking
2
Division must adopt rules; June 2, 2025 proposal lapsed June 2, 2026 without adoption, so no rules in force.P.L.2023, c.266, § 15 · secondary source · source ↗
Re-proposal timing unknown as of October 2026.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws