{ "jurisdiction_id": "US-NJ", "jurisdiction": "United States – New Jersey", "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 46, "sub_modules": 57, "source_register": 14 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core comprehensive statute is in force with a named enforcement authority and settled effective date; residual amber risk sits in still-pending AG rulemaking and the not-yet-operative data-broker registry.", "claims": [ { "statement": "The Office of the Attorney General enforces the NJDPL, and consumers cannot file lawsuits on their own behalf under the law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Jersey Data Privacy Law, P.L.2023, c.266, guarantees New Jersey consumers certain rights with regard to their personal data and imposes requirements on controllers and processors, taking effect 15 January 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "NJDPL applies to controllers/processors that during a calendar year either control or process the personal data of at least 100,000 consumers, or control or process the personal data of at least 25,000 consumers and make money from the sale of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A consumer under the NJDPL is a New Jersey resident acting in an individual or household context; a New Jersey resident's data collected in an employment context is not protected under the law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Jersey's 2026 data broker law creates a tiered annual registration-fee structure, with the largest data brokers and collectors required to pay a $1.5 million annual registration fee, and the second fee tier (higher than any other state) triggered at 100,000 consumers; the Division's registry requirement takes effect 270 days after enactment, on 27 March 2027.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/independence-day-surprise-new-jersey-s-costly-new-data-broker-law", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Sensitive-data consent and consumer opt-out mechanics are well evidenced; the absence of a GDPR-style Art.6 lawful-basis catalogue and of an explicit anonymisation safe-harbour is a structural gap relative to omnibus regimes.", "claims": [ { "statement": "Consumers may opt out of a controller selling their personal data or using it for targeted advertising and certain types of profiling, in lieu of a GDPR-style enumerated lawful-basis requirement for processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The controller must get the consumer's consent before processing the consumer's sensitive data, and must obtain consent before processing personal data of a consumer the controller knows or willfully disregards as being between 13 and 16 years old.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Sensitive data under the NJDPL is a subset of personal data revealing racial or ethnic origin, religious beliefs, health condition, financial information, sexual activity or orientation, immigration or citizenship status, transgender or non-binary status, genetic or biometric data, precise geolocation data, or personal data collected from a known child.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "De-identified data is data that cannot be linked to or used to infer information about a specific individual or a device linked to that individual, and is considered de-identified only if the controller takes steps to ensure it cannot be linked to the consumer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights bundle and response deadlines are directly evidenced by regulator and industry sources; itemised statutory text for rectification specifically was not independently isolated from a single named clause, warranting slightly lower confidence there.", "claims": [ { "statement": "The NJDPL grants consumers the right to confirm whether a controller is processing their personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/DG-new-jersey-consumer-privacy-act-act-infographic.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers may request data erasure (deletion) under specified conditions set out in the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/DG-new-jersey-consumer-privacy-act-act-infographic.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers may opt out of a controller selling their personal data or using it for targeted advertising and certain types of profiling, such as profiling to determine loan, employment, or insurance eligibility.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers may obtain a copy of their personal data in a portable, machine-readable format under the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/DG-new-jersey-consumer-privacy-act-act-infographic.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Organizations have 45 days to respond to a consumer rights request under the NJDPL, with an optional 45-day extension.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/DG-new-jersey-consumer-privacy-act-act-infographic.pdf", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "DPIA-equivalent, processor-contract, and breach-notification duties are well evidenced and binding; DPO appointment and formal ROPA requirements are not evidenced and are flagged as gaps rather than fabricated.", "claims": [ { "statement": "Section 9 of the NJDPA requires controllers to conduct and document a data protection assessment prior to initiating any processing activity that presents a heightened risk of harm to consumers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/new-jersey-privacy-impact-assessment", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Processing presents a heightened risk of harm when there is risk of unfair treatment, illegal discrimination, or financial or physical injury, or when the controller processes sensitive data, triggering the DPA requirement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A processor may only process personal data at the request and under the direction of a controller, and must enter into a contract with the controller containing processing instructions, identifying the data processed and retention duration, and requiring return or deletion of the data once processing is complete.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers are required to take reasonable measures to establish, implement, and maintain administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/DG-new-jersey-consumer-privacy-act-act-infographic.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Any business conducting business in New Jersey must disclose a breach of security of computerized records to any affected New Jersey resident in the most expedient time possible and without unreasonable delay.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A business or public entity must, in advance of disclosing a breach to affected customers, report the breach and related information to the Division of State Police in the Department of Law and Public Safety.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Processor contracts under the NJDPL must require the processor to return or delete personal data once processing is complete.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No transfer-mechanism, adequacy, or localisation provisions exist in the NJDPL or ancillary NJ statutes reviewed; module is populated with an explicit absence finding rather than left silently empty.", "claims": [] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial, health, and credit-sector carve-outs are well evidenced; education and insurance-specific overlay detail beyond the general GLBA/HIPAA/FCRA exclusions was not independently verified.", "claims": [ { "statement": "Data collected by certain financial and insurance institutions is excluded from the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Financial institutions must provide consumers an annual privacy notice regarding nonpublic personal information, and consumers may opt out of disclosure of that information at any time.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/News/Consumer%20Briefs/what-you-should-know-about-privacy-notices.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Health information protected by HIPAA is excluded from the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A New Jersey resident whose personal data is collected by a potential employer while applying for a job is not protected under the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data that can be processed under the federal Fair Credit Reporting Act is excluded from the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Jersey consumers have the right to place a security freeze on their consumer report under the Identity Theft Prevention Act, preventing release of report information without express authorization.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Various privacy-related provisions in the New Jersey Revised Statutes and New Jersey Administrative Code create obligations for data collected by companies in the education sector, in addition to the NJDPL.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/new-jersey?topic=notes", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nonpublic personal information collected by insurance companies is subject to GLBA-style annual privacy-notice and opt-out requirements administered with New Jersey Division of Consumer Affairs involvement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/News/Consumer%20Briefs/what-you-should-know-about-privacy-notices.pdf", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "green", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Opt-out and UOOM obligations are binding and in force; dark-patterns, clean-room, and direct-marketing-specific sub-modules lack dedicated statutory findings and are flagged amber/red accordingly.", "claims": [ { "statement": "A controller's privacy notice must clearly state how consumers may exercise their rights under the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "By 15 July 2025, controllers must honor opt-out signals sent by consumers through universal opt-out mechanisms, such as Global Privacy Control, which allow automatic opt-out across websites, platforms, or devices.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Under the NJDPL, universal opt-out mechanisms must support consumer opt-outs for profiling in furtherance of decisions that produce legal or similarly significant effects, in addition to targeted advertising and sales of personal data, a scope broader than most peer state laws.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/nuances-highlight-new-jerseys-comprehensive-privacy-bill", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Profiling opt-out and sensitive-data (biometric/genetic) consent duties are binding and evidenced; dedicated AI-risk-assessment and biometric-specific statutory regimes are not evidenced for New Jersey and are flagged as gaps.", "claims": [ { "statement": "Under the NJDPL, universal opt-out mechanisms cover profiling 'in furtherance of decisions that produce legal or similarly significant effects concerning a consumer,' with examples including denial or provision of financial, lending, housing, insurance, education, criminal justice, employment, health care, or essential goods/services decisions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/nuances-highlight-new-jerseys-comprehensive-privacy-bill", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NJDPL requires completed data protection assessments before a significant-effect profiling activity is carried out.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/nuances-highlight-new-jerseys-comprehensive-privacy-bill", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Biometric data is included within the NJDPL's definition of sensitive data, requiring consumer consent before processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Genetic data is included within the NJDPL's definition of sensitive data, requiring consumer consent before processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data collected by state agencies is excluded from the NJDPL.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Age-13-16 consent threshold and 'known child' sensitive-data treatment are binding and evidenced; age-verification mechanics, education-settings specifics, and dependent-adult protections are not evidenced and flagged as gaps.", "claims": [ { "statement": "Federal law regulates the online privacy of children under age 13, and in New Jersey, when a controller knows or willfully disregards that a consumer is between 13 and 16 years old, the controller must obtain the consumer's consent before processing the consumer's personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Personal data collected from a known child is included within the NJDPL's definition of sensitive data, requiring the controller to obtain consent before processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-jersey/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Core enforcement architecture (AG-only, no PRA, penalty caps, cure period) is well evidenced and now largely operative post-July-2026; recent legislative activity (data broker law) and limited public track record of concluded NJDPL enforcement actions keep this amber rather than green.", "claims": [ { "statement": "The Attorney General may go to court to stop NJDPL violations, seek compensation for victims, and require a violator to pay up to $10,000 for an initial offense and $20,000 for subsequent offenses.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Jersey's 2026 data-broker law amends the NJDPL to prohibit the sale of sensitive data, with violations carrying a $50,000-per-record fine.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/independence-day-surprise-new-jersey-s-costly-new-data-broker-law", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Attorneys general in California, Colorado, Connecticut, Delaware, Indiana, New Jersey and Oregon, along with the California Privacy Protection Agency, have formed the bipartisan Consortium of Privacy Regulators to collaborate on enforcing their respective state privacy laws.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/emerging-trends-insights-from-public-enforcement-of-us-state-privacy-laws", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Jersey is among the states, including California, Connecticut, New Hampshire, Oregon, Texas and Virginia, that have created privacy-focused subunits within their Attorney General's office.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/emerging-trends-insights-from-public-enforcement-of-us-state-privacy-laws", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Jersey's Daniel's Law, protecting personal information of judges, law enforcement personnel and other public officials, has driven a substantial wave of private lawsuits and constitutional challenges against data brokers and consumer-facing businesses.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-litigation-series-data-brokers-judicial-privacy", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers cannot file lawsuits on their own behalf under the NJDPL; the Office of the Attorney General enforces the law exclusively.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "New Jersey Division of Consumer Affairs", "source_url": "https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "On 30 June 2026, Governor Mikie Sherrill signed A 5328 into law, making New Jersey the seventh state to enact a data broker law and the second state to do so in 2026, following Connecticut.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/independence-day-surprise-new-jersey-s-costly-new-data-broker-law", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }