Ask a New Jersey resident or business owner about “the data law” right now and you’re likely to get two entirely different answers depending on who you ask and when they last checked the news. New Jersey has actually enacted two separate, significant pieces of consumer privacy legislation in recent years, and each one addresses a genuinely distinct piece of how personal data gets collected, used, and sold. Understanding which law applies to which situation matters enormously, whether you’re a resident trying to understand your own digital rights or a business trying to stay compliant with New Jersey’s increasingly assertive approach to data privacy.
The law generating the most immediate news coverage right now is Assembly Bill 5328, New Jersey’s sweeping new data broker ban, which took effect immediately upon being signed into law on June 30, 2026. Legal experts have already flagged this statute as one of the strictest data-selling regulations anywhere in the country, and the penalties attached to it make clear the state intends that reputation to hold. Under the new law, selling or licensing sensitive personal data, including geolocation information, health data, and biometric data, is now completely prohibited outright, not merely restricted or regulated. Companies caught violating that prohibition face a civil penalty of $50,000 per record sold, a genuinely severe financial deterrent given how many individual records a single data transaction can involve.
What makes New Jersey’s approach here particularly distinctive is how the law defines who actually falls under its authority. Rather than simply targeting data brokers themselves, the statute creates an entirely new legal category covering what it calls data collectors, companies that maintain a direct relationship with consumers, whether that’s an app someone uses daily or a retail store where they shop regularly. If any of these data collectors turn around and sell that consumer information downstream to a third-party broker, they now face significant registration fees and strict penalties of their own, effectively closing off a loophole that had allowed companies with direct consumer relationships to quietly funnel data into the broader broker marketplace without facing the same scrutiny brokers themselves encounter. That structural choice, regulating the companies that generate the data in the first place rather than only the brokers reselling it, sets New Jersey’s law apart from similar data broker regulations passed in other states.
The second major piece of legislation, and the one most people actually mean when they first hear about New Jersey’s broader privacy protections, is the New Jersey Data Privacy Act, which went into effect back on January 15, 2025. Rather than focusing narrowly on data sales like the newer broker ban, the NJDPA establishes a much broader consumer privacy framework, granting New Jersey residents a genuine set of fundamental digital rights over their own personal information for the first time at the state level.
Those rights are substantial. Under the NJDPA, New Jersey residents can formally access, correct, delete, or port the personal data that companies have collected on them, giving individuals real, actionable control over information that had previously existed largely outside their reach once a company collected it. Residents also carry the legal right to opt out entirely of targeted advertising and the sale of their standard personal data, a protection that extends well beyond the narrower sensitive-data category covered by the newer broker ban. Perhaps most notably, New Jersey has built genuine urgency into how companies must respond to these requests, requiring businesses to process consumer opt-out requests within just 15 days, a considerably faster turnaround than comparable privacy laws in states like California or Virginia, where response windows tend to stretch considerably longer.
The NJDPA’s reach is broad but not unlimited. The law applies to any business, nonprofit organization, or university operating within New Jersey that handles the personal data of at least 100,000 residents annually, a threshold designed to capture the companies and institutions actually processing data at meaningful scale while sparing genuinely small operations from the same compliance burden faced by larger organizations.
Taken together, these two laws give New Jersey residents a genuinely comprehensive privacy framework, one that operates on two complementary levels. The NJDPA establishes the baseline rights every resident holds over their own personal data, the ability to see it, correct it, delete it, move it elsewhere, or simply say no to having it sold or used for targeted advertising in the first place. The newer data broker ban then adds a considerably sharper, more targeted layer on top of that foundation, specifically slamming the door shut on the sale of the most sensitive categories of personal information, regardless of whether a consumer ever formally opted out under the broader NJDPA framework. For businesses operating in New Jersey, that means compliance now genuinely requires understanding both statutes rather than assuming one covers the full picture, since a company could technically satisfy its NJDPA opt-out obligations while still running headlong into the far steeper penalties attached to selling sensitive data under the new broker ban. For residents, the practical takeaway is considerably simpler: New Jersey now stands among the more aggressive states in the country when it comes to protecting personal data, whether the conversation is about a company selling your location history to a broker or simply respecting your right to say no to targeted ads in the first place.
