New Jersey Data Privacy Act (NJDPA) Reference Guide

The general NJDPA applies to a controller that conducts business in New Jersey or produces products or services targeted to New Jersey residents and, in a calendar year, either controls or processes personal data of at least 100,000 New Jersey consumers (excluding data processed solely to complete a payment transaction), or handles data of at least 25,000 consumers while deriving revenue or receiving a discount from selling personal data. It does not impose a general gross-revenue threshold. N.J.S.A. § 56:8-166.5

A consumer is a New Jersey resident acting in an individual or household context—not a person acting in an employment or commercial context. Nonprofits and smaller businesses are not categorically exempt when they meet the applicable test. Processors also have duties when handling covered data for a controller. New Jersey Division of Consumer Affairs: NJDPL FAQ

The statute specifies exclusions for particular entities or categories of information, including certain HIPAA-protected information, GLBA-regulated financial institutions and data, insurance institutions, FCRA-governed data, state agencies, and qualifying research. Whether an exclusion applies to a given activity is a legal question; it does not make every use of an organization’s data automatically exempt. N.J.S.A. § 56:8-166.13

P.L. 2026, c.25 added a prohibition on selling sensitive data that applies to individuals and legal entities regardless of how many consumers’ records they process. It separately established data-broker and data-collector obligations. Those provisions do not turn every organization into a data broker, and a consent banner is not a blanket exception to the sensitive-data sales ban. Counsel should examine the definitions, exclusions, recipient relationships, and any registration duties. New Jersey Legislature: P.L. 2026, c.25

New Jersey gives consumers several rights that must be usable, not merely mentioned in a privacy notice. Controllers need request and appeal processes, transparent disclosures, data minimization, appropriate security, consent for sensitive-data processing, and a way to pass opt-outs into the systems that use or share data. New Jersey Legislature: P.L. 2023, c.266

Personal data means information linked or reasonably linkable to an identified or identifiable person. On a website, that may include account and device identifiers, browsing history, page activity, and data combined with other sources. Whether a particular identifier or disclosure is covered requires examining the actual data flow and context. N.J.S.A. § 56:8-166.4

New Jersey’s sale definition covers sharing, disclosing, or transferring personal data for monetary or other valuable consideration, with specified exceptions including processor, requested-service, and affiliate disclosures. Targeted advertising generally involves ads selected using activity across nonaffiliated sites or apps over time; contextual and certain first-party advertising and measurement are excluded. A network request is not, by itself, proof of a statutory sale or targeted advertising. N.J.S.A. § 56:8-166.4

Advertising pixels, tag-manager rules, attribution vendors, embedded tools, and hard-coded scripts can transmit identifiers or page activity before a visitor ever fills out a form. If a consumer opts out, a privacy platform may record the choice while one of those routes still sends data. That is why both the user-facing choice and downstream behavior need testing.

By July 15, 2025—six months after the law took effect—covered controllers processing personal data for sale or targeted advertising had to accept user-selected universal opt-out mechanisms. New Jersey’s Division of Consumer Affairs cites Global Privacy Control as an example. The statute addresses qualifying mechanisms generally; it does not name GPC as the sole permitted signal. N.J.S.A. § 56:8-166.11 New Jersey Division of Consumer Affairs: NJDPL FAQ

A consumer can designate an authorized agent to opt out, including through browser or device technology, subject to the law’s verification conditions. The universal mechanism must be user-friendly and communicate a genuine selection. The Division may issue technical specifications by regulation. Until a proposal is adopted, its proposed details should not be presented as binding rules. N.J.S.A. § 56:8-166.11

The New Jersey Office of the Attorney General has sole and exclusive authority to enforce the NJDPA. The Act creates no private right of action. Violations are unlawful practices under the state Consumer Fraud Act. The Division of Consumer Affairs says the Attorney General may seek an injunction, compensation, and penalties of up to $10,000 for an initial offense and $20,000 for subsequent offenses. N.J.S.A. §§ 56:8-166.17 and 56:8-166.19 New Jersey Division of Consumer Affairs: NJDPL FAQ

The Act’s temporary notice-and-30-day-cure procedure ran only through the first 18 months after the January 2025 effective date. That period has ended; do not assume a guaranteed cure notice before enforcement. The Division’s FAQ described the grace period as running until July 1, 2026. N.J.S.A. § 56:8-166.17

On June 30, 2026, New Jersey approved P.L. 2026, c.25. Its sensitive-data sales prohibition applies regardless of ordinary NJDPA volume thresholds, and its data-broker and data-collector provisions establish distinct obligations and penalties. The statute took effect immediately except for a registry provision that remained inoperative for 270 days. These are not equivalent to an ordinary opt-out request; legal counsel should review whether any contemplated transfer is a prohibited sale. New Jersey Legislature: P.L. 2026, c.25

The privacy team defines what the organization is permitted or required to do. The technical team tests whether the website actually behaves that way. Neither a passing technical scan nor a well-written notice replaces the other workstream.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This guide relies on the enacted New Jersey laws and the Division of Consumer Affairs’ published guidance. Proposed implementing rules are identified as proposed; this page does not treat them as final. Secondary sources are not treated as authority for the law.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website tracking: visitor choice, browser privacy signals, cookies, scripts, tags, and network requests. Your legal and privacy team remains responsible for interpretation, applicability, exemptions, sale and sensitive-data classification, data-broker questions, notices, contracts, rights requests, assessments, security, retention, and organization-wide governance.