Personal Information and Privacy Protection Act (retail ID card scanning)
NJ PIPPA
Other · Data security · Marketing
New Jersey retailers may scan a customer's ID card only for eight listed purposes, such as verifying identity for non-cash payments or returns, checking age, preventing return or credit fraud, or meeting legal requirements. They may capture only name, address, date of birth, issuing state, and ID number, may not keep data scanned for identity or age checks, and may not sell or share scanned data for marketing.
- Where
- New Jersey
- Citation
- N.J.S.A. 56:11-53 to 56:11-55; P.L.2017, c.124 (S1913)
- Status
- In force
- In force since
- 2017-10-01
- Enforced by
- Civil penalties collected in a summary proceeding under the Penalty Enforcement Law of 1999; aggrieved persons may sue in Superior Court
- People can sue
- Yes
- Penalties
- Civil penalty of $2,500 for a first violation and $5,000 for each later violation, plus damages in a private action by any aggrieved person (56:11-55).
- Applies to
- Retail establishments that scan the barcode or machine-readable zone of a driver's license, probationary license, non-driver photo ID, or similar out-of-state card (56:11-54(a))
Practices it requires
- Scan an ID card only for one of eight listed purposes (identity verification for non-cash payments, returns, or exchanges; age verification; return-fraud or credit-fraud prevention; contracts; legal requirements; FCRA/GLBA/FDCPA transmissions; HIPAA covered-entity records).N.J.S.A. 56:11-54(b)
- Collect only the person's name, address, date of birth, issuing state, and ID card number.N.J.S.A. 56:11-54(c)
- Do not retain information scanned to verify identity or age.N.J.S.A. 56:11-54(d)(1)
- Do not sell or disseminate scanned information to third parties, including for marketing, advertising, or promotions, except as the permitted purposes require.N.J.S.A. 56:11-54(d)(3)
Security duties
- Securely store any information retained for the other permitted purposes and report any breach to the State Police and affected persons under the breach law (56:8-163).N.J.S.A. 56:11-54(d)(2)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective date computed as the first day of the third month after approval on July 21, 2017 (October 1, 2017). | Later amendments were not checked in the statutes database.
Research reference, not legal advice.