Privacy Law Library

Data Broker and Data Collector Registration and Sensitive Data Sale Ban (P.L.2026, c.25)

NJ Data Broker Law

Data brokers · Health · Genetic · Biometric · Location · Children

This 2026 law creates an annual registry of data brokers and data collectors that sell or license New Jersey consumers' personal data, with fees scaled by the number of consumers affected, and requires detailed disclosures about opt-out, deletion, breach history, and minors' data. It also bars data brokers and data collectors from selling or licensing sensitive data to anyone, backed by a $50,000-per-record penalty. The law took effect on signing, but the Division's public registry duty became operative 270 days later.

Where
New Jersey
Citation
N.J.S.A. 56:8-166.20 to 56:8-166.24; P.L.2026, c.25 (A5328 1R), ss. 2-8
Status
In force
In force since
2026-06-30
Enforced by
New Jersey Division of Consumer Affairs (registration, fees, and penalties collected in a summary proceeding under the Penalty Enforcement Law of 1999)
People can sue
No
Penalties
Failing to register or pay the annual fee: back fees plus $2,500 per day; failing to submit or update required information: $2,500 per day (56:8-166.21). Selling, offering for sale, or licensing sensitive data: $50,000 per record (56:8-166.23).
Applies to
  • Data brokers: persons or legal entities (including NJDPA controllers) that knowingly collect or buy personal data of consumers with whom they have no direct relationship and sell or license it to a third party (56:8-166.20(a))
  • Data collectors: businesses that knowingly collect personal data of consumers with whom they have a direct relationship and sell or license it to a data broker (56:8-166.20(a))
  • No minimum volume threshold; the fee tier starts at 100,000 or fewer New Jersey consumers
  • Exclusions include government entities; activity incidental to e-commerce platforms, 411 directory services, publicly available professional or financial/real estate information, health-and-safety alert services, and regulated title and settlement services; nonprofit postsecondary enrollment reporting services; and HIPAA, GLBA, insurance, FCRA, DPPA, human-subjects research, insurance-support organization, and national securities association carve-outs (56:8-166.20(e)-(g); 56:8-166.22(b))

Practices it requires

  • Never sell or license sensitive data (racial or ethnic origin, religion, health, financial account credentials, sex life or orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, a known child's data, precise geolocation within 1,750 feet) to any individual or entity.N.J.S.A. 56:8-166.22(a); 56:8-166.20(a)

Registration

  • Register annually with the Division of Consumer Affairs and pay a fee tiered by the number of New Jersey consumers whose data is sold or licensed, from $5,000 (100,000 or fewer) up to $1,500,000 (more than 4.5 million).N.J.S.A. 56:8-166.20(c)
  • At registration and at least annually, disclose name and addresses, opt-out and deletion options (including authorized-agent opt-outs), activities that cannot be opted out of, any purchaser credentialing process, processors used, and practices for data of people under 18.N.J.S.A. 56:8-166.20(d)(1)-(5), (7), (9)
  • Report a history of data breaches and cybersecurity events with the number of individuals affected; the Division may not publish this item.N.J.S.A. 56:8-166.20(b), (d)(6)

Other duties

  • The Division must maintain a public registry listing each registrant's name, address, contact email, website, privacy-policy URL, and opt-out information, reviewed at least annually.N.J.S.A. 56:8-166.20(b); P.L.2026, c.25, s.8 · Only if: Registry provision inoperative for 270 days after enactment · From 2027-03-27

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Registry operative date computed as 270 days after June 30, 2026 (March 27, 2027); the Division has not been confirmed to have set a registration window. Secondary sources say registration is expected April to June 2027. | Implementing rules under section 7 had not been located as proposed or adopted as of 2026-09-25. | Whether a 'data broker, including a controller' in s.5 subjects NJDPA controllers below the NJDPA thresholds to the $50,000-per-record penalty turns on 56:8-166.12(a)(6); the interaction has not been tested in court. | Enforcement posture: on July 10, 2026 the Division of Consumer Affairs issued an alert (reported by the New Jersey Globe) saying brokers need not register or pay fees until a registry opens in spring 2027 and that it will issue guidance on the sensitive-data ban; a senior administration official said the State would not enforce the law until the Legislature fixes defects (notably the lack of a political-campaign/voter-data exemption). The DCA alert itself could not be retrieved because the Division's site blocks automated access, and no amending law had been found as of 2026-09-25.

Research reference, not legal advice.