New Jersey
New Jersey Data Privacy Act
New Jersey’s consumer privacy law. It gives New Jersey residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 15, 2025
- Citation
- N.J. Stat. § 56:8-166.4 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 100,000+ New Jersey residents a year, or 25,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Honor Global Privacy Control as an opt-out (from Jul 15, 2025).
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- Don’t sell sensitive data (added by P.L.2026, c.25).
Who has to comply
The New Jersey Data Privacy Act took effect on January 15, 2025. It applies to businesses that do business in New Jersey or target its residents and handle the personal data of 100,000 or more New Jersey consumers (not counting payment-only data), or 25,000 or more while earning any revenue, or a discount, from selling personal data. There’s no percentage test. The Division of Consumer Affairs says nonprofits and small businesses must comply if they meet the thresholds.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling.
- Respond within 45 days, extendable by 45 more where reasonably necessary.
- Appeals: answer within 45 days; if you deny, give an online way to complain to the Division of Consumer Affairs.
Global Privacy Control from July 15, 2025
Since July 15, 2025, businesses that use data for targeted advertising or sell it must let consumers opt out through a user-selected universal opt-out mechanism. The law doesn’t name Global Privacy Control, but GPC is that kind of signal.
Sensitive data and teens
Sensitive data needs consent first. New Jersey’s definition includes financial information (such as an account or card number with its security code or password), status as transgender or non-binary, citizenship or immigration status, genetic and biometric data, children’s data and precise geolocation.
For consumers you know, or willfully disregard, are 13 to 16, you need their consent before targeted advertising, sale or profiling.
A law approved on June 30, 2026 (P.L.2026, c.25) adds a ban on selling sensitive data that applies to every business, whatever its size, alongside a new data broker registry.
Enforcement
The Attorney General’s office has sole enforcement authority, under the Consumer Fraud Act; there’s no private right of action. The Division of Consumer Affairs puts penalties at up to $10,000 for a first offense and $20,000 for later ones. The 30-day cure period ended on July 1, 2026.
Regulations proposed in June 2025 were never adopted, so the statute is the rule for now.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Global Privacy Control
On by default. Honored as an opt-out, shown to the visitor, and logged with the consent record.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does New Jersey’s privacy law apply to nonprofits?
Yes. The Division of Consumer Affairs says nonprofits and small businesses must comply if they meet the thresholds.
Do I have to honor Global Privacy Control in New Jersey?
Since July 15, 2025, businesses that do targeted advertising or sell data must accept user-selected universal opt-out signals such as GPC.
Is there still a cure period?
No. It ended on July 1, 2026.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
