Regulationsby GlyphNew Jersey NJDPA
Amended New Jersey · In force Jan 15, 2025 · no upcoming deadlines
Deadlines
Mandatory 30-day cure period expiresThe Division's duty to issue a cure notice before enforcement ends on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b)).
A5328 sensitive data sale ban takes effectA5328, signed June 30, 2026, prohibits selling sensitive personal data; the ban took effect on signing.
Universal opt-out mechanism must be honoredControllers that sell personal data or process it for targeted advertising must honor user-selected universal opt-out signals within six months of the effective date (N.J.S.A. 56:8-166.11).
Division of Consumer Affairs proposes NJDPA rules (N.J.A.C. 13:45L)Proposed rules published at 57 N.J.R. 1101(a); comments were due Aug 1, 2025.
NJDPA takes effectThe act takes effect on the 365th day after enactment on Jan 16, 2024 (sec. 17).
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, consent for targeted advertising/sale/profiling of known 13-17 year olds, universal opt-out signal support and data protection assessments. It has no revenue-share floor for the smaller threshold, and the Division of Consumer Affairs has rulemaking authority. A June 2026 law (A5328) bans selling sensitive data and creates a data broker registry.
- Who it applies to
- Controllers conducting business in NJ or targeting NJ residents that in a calendar year control or process personal data of at least 100,000 consumers (excluding payment-only data), or at least 25,000 consumers where the controller derives revenue or receives a discount from selling personal data (any amount). Exempts GLBA financial institutions, HIPAA PHI, and certain other regulated data; nonprofits are NOT exempt.
- Penalties
- Violations are unlawful practices under the NJ Consumer Fraud Act (N.J.S.A. 56:8-1 et seq.): civil penalties up to $10,000 for the first violation and $20,000 for each subsequent violation (N.J.S.A. 56:8-13). 30-day cure notice required, where a cure is deemed possible, until July 1, 2026 (the first day of the 18th month after the effective date; N.J.S.A. 56:8-166.17). No private right of action.
- Enforced by
- New Jersey Attorney General / Division of Consumer Affairs
- Official name
- New Jersey Data Privacy Act (P.L.2023, c.266; S332)
- Citation
- P.L.2023, c.266; N.J.S.A. 56:8-166.4 et seq.
- Topics
- Privacy, Children
Research notes
Rules status: proposed N.J.A.C. 13:45L published June 2, 2025 (57 N.J.R. 1101(a)); no notice of adoption could be confirmed as of Sept 22, 2026. Under NJ's APA a proposal expires one year after publication unless adopted, so check whether the Division re-proposed. A5328 (signed June 30, 2026) details come from Covington Inside Privacy and Venable because the NJ Legislature bill page renders only via JavaScript and could not be read. It also creates a data broker registry with what are reported as the highest fees in the US; data broker obligations are reported to start 270 days after enactment (around late March 2027). That date is omitted because the exact start could not be verified.
Related
Questions about New Jersey NJDPA
- What are the New Jersey NJDPA compliance deadlines?
- Jan 15, 2025: NJDPA takes effect. Jun 2, 2025: Division of Consumer Affairs proposes NJDPA rules (N.J.A.C. 13:45L). Jul 15, 2025: Universal opt-out mechanism must be honored. Jun 30, 2026: A5328 sensitive data sale ban takes effect. Jul 1, 2026: Mandatory 30-day cure period expires.
- When does New Jersey NJDPA take effect?
- New Jersey NJDPA took effect on Jan 15, 2025.
- Who does New Jersey NJDPA apply to?
- Controllers conducting business in NJ or targeting NJ residents that in a calendar year control or process personal data of at least 100,000 consumers (excluding payment-only data), or at least 25,000 consumers where the controller derives revenue or receives a discount from selling personal data (any amount). Exempts GLBA financial institutions, HIPAA PHI, and certain other regulated data; nonprofits are NOT exempt.
- What are the penalties under New Jersey NJDPA?
- Violations are unlawful practices under the NJ Consumer Fraud Act (N.J.S.A. 56:8-1 et seq.): civil penalties up to $10,000 for the first violation and $20,000 for each subsequent violation (N.J.S.A. 56:8-13). 30-day cure notice required, where a cure is deemed possible, until July 1, 2026 (the first day of the 18th month after the effective date; N.J.S.A. 56:8-166.17). No private right of action.