Consumer Data Privacy
New Jersey Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What New Jersey’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
The law generally follows the Virginia structure, but there are entire paragraphs and provisions found in laws like Connecticut's that are missing from this law. The definition of sensitive personal data broadly includes financial information. The law also has unique definitions of biometric data and processing, and omits a key exception in the definition of sale. The law has narrower exemptions — for example, there is no non-profit exemption, and only a PHI-level (not entity-level) exemption. The law also does not have a FERPA exemption. It contains increased protections for children's data. The law authorizes the promulgation of regulations; however, they have not yet been issued. The law was amended in 2026 to prohibit the sale of sensitive data, with that provision applying to all entities operating in the state. Violations of that prohibition are subject to fines of $50,000 for each record sold, offered for sale, or licensed.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Main Provisions | |
| Annual gross revenue | N/A |
| Consumers whose data is processed | 100,000 consumers 1.07% of state's 9.3 million population |
| Revenue from sale of personal data | Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of 25,000 or more consumers. |
| Not Sell Sensitive Data | |
| Annual gross revenue | – |
| Consumers whose data is processed | – |
| Revenue from sale of personal data | – |
| Other conditions |
|
Consumer rights under New Jersey's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
| Data portability | Yes |
| Delete | Yes |
| Correct inaccuracies | Yes |
Not be discriminated against for exercising rightsnoteRight applies only when consumer opts out of targeted advertising, sales, or profiling. | Partial |
| Opt-out of sale | Yes |
| Opt-out of targeted advertising/sharing | Yes |
| Opt-out of certain types of profiling | Yes |
| Opt-out of ADMT | No |
| Recognize opt-out signals | Yes |
| Revoke consent | Yes |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data13
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Mental or physical health condition
- Mental or physical health treatment
- Sexual orientation
- Sex life
- Status as transgender or nonbinary
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data. - Financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account
How sensitive data must be treated3
- Obtain Consent to Process
- Cannot Sell Sensitive Data
note
New Jersey provides for a civil penalty of $50,000 for each record sold, offered for sale, or licensed in violation of this prohibition. - Conduct Data Protection or Risk Assessment
Requirements for minors' data2
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
- Opt-in for targeted advertising, sale of personal data, and profiling for consequential decisions of children ages 13-16
Activities that trigger a risk or impact assessment4
- Targeted advertising (“sharing”)
- Sale of personal data
- Processing of sensitive data
- Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
Other notable provisions10
- Definition of “Sale” Includes “Other Valuable Consideration”
- Applies to Nonprofits
- Data Processing Agreements
- Privacy Policy
- Duty of Purpose Specification
- Implement Reasonable Data Security Measures
- Duty to Avoid Secondary Use
- Data Minimization
- Attorney General Enforcement
- Rulemaking
Key dates1
| Date | What happens |
|---|---|
| January 15, 2025 | New Jersey's consumer data privacy law takes effect |
Questions about New Jersey’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.