New Jersey (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| New Jersey Data Privacy Act | P.L.2023, c.266; N.J.S.A. 56:8-166.4 to 56:8-166.19 | In force | 15 January 2025 |
| Data brokers and sensitive data Act | P.L.2026, c.25; N.J.S.A. 56:8-166.20 to 56:8-166.24 | In force | 30 June 2026 |
| Identity Theft Prevention Act (security breach notice) | P.L.2005, c.226; N.J.S.A. 56:8-161 to 56:8-166 | In force | 1 January 2006 |
| New Jersey Age-Appropriate Design Code (Kids Code Act) | P.L.2026, c.73 (A4015 ACS, third reprint) | Enacted, not yet in force | 1 September 2027 |
- New Jersey Data Privacy Act: Amended by P.L.2025, c.367 (approved 20 January 2026), which widened de-identified data and the exemptions, and by P.L.2026, c.25 (approved 30 June 2026), which bans selling sensitive data.
- Data brokers and sensitive data Act: Took effect on approval, except that the Division’s public registry of data brokers starts 270 days later.
- New Jersey Age-Appropriate Design Code (Kids Code Act): Approved on 11 August 2026. It takes effect on the first day of the 13th month after enactment, which is 1 September 2027. The Attorney General may adopt rules.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to controllers doing business in New Jersey or targeting its residents that in a calendar year control or process data of 100,000+ consumers (excluding payment-only data), or 25,000+ while earning any revenue or discount from selling data. Non-profits are covered. GLBA financial institutions, insurers and HIPAA-protected health data are exempt. Employees and B2B contacts aren’t consumers. The 2026 ban on selling sensitive data applies to everyone, whatever their size.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54668 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54676 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54675
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data and to opt out of targeted advertising, sale and profiling for significant decisions, within 45 days (extendable by 45). Sensitive data needs opt-in consent, and since 30 June 2026 it may not be sold at all. The law tells the Division of Consumer Affairs to adopt rules, but we found none adopted; a New Jersey rule proposal that isn’t adopted within a year of publication expires.
Sources: pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54675 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54681 · nj.gov/oal/rules/portal
Leads, not sources: troutmanprivacy.com/2026/06/new-jerseys-proposed-data-privacy-regulat…
Consent age for online services
Section titled “Consent age for online services”A child is under 13 (as in COPPA), and a known child’s data must be processed as COPPA requires. Teens aged 13 to 16 must consent before their data is used for targeted advertising, sold, or used for profiling with significant effects, if the controller knows or wilfully disregards their age. From 1 September 2027 the Kids Code also protects users known to be under 18.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54675 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54667 · pub.njleg.state.nj.us/Bills/2026/A4500/4015_R3.PDF
Children
Section titled “Children”Data from a known child (under 13) is sensitive data, so it may not be sold, and data brokers must say how they handle under-18s’ data. From 1 September 2027 the Kids Code covers services built around interacting with other account holders’ content, likely to be used by under-18s (child-directed, or 2%+ of users aged 2 to 17), with over $25 million revenue or data of 25,000+ consumers or households. For known under-18s they need top privacy defaults, no dark patterns, minimal data and no notifications by default, at night or in school hours, and must delete age-check data within 15 days.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54675 · pub.njleg.state.nj.us/Bills/2026/PL26/25_.PDF · pub.njleg.state.nj.us/Bills/2026/A4500/4015_R3.PDF · njleg.state.nj.us/bill-search/2026/A4015 · nj.gov/governor/news/2026/20260811a.shtml
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers that process data for targeted advertising or sell it must let consumers opt out, and since 15 July 2025 must honour a user-selected universal opt-out mechanism such as Global Privacy Control. The Division may set technical rules for such signals.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54674 · pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF
Electronic marketing
Section titled “Electronic marketing”Telemarketers must register with the Division of Consumer Affairs every year, must not call numbers on the state no-call list (built on the federal registry) or between 9 p.m. and 8 a.m., must identify themselves within 30 seconds, and must not block caller ID. Email and text marketing otherwise follow federal CAN-SPAM and the TCPA.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54616 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54622 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54623
Breach notification
Section titled “Breach notification”Before telling customers, report the breach to the New Jersey State Police. Then notify affected residents in the most expedient time possible and without unreasonable delay, unless misuse isn’t reasonably possible (document that and keep it 5 years). If more than 1,000 people are notified, also tell the national consumer reporting agencies.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54661 · pub.njleg.state.nj.us/Bills/2004/PL05/226_.PDF
Registration and fees
Section titled “Registration and fees”Since 30 June 2026, data brokers, and businesses that sell data they collect to data brokers, must register with the Division every year and pay a fee from $5,000 to $1.5 million depending on how many New Jersey consumers’ data they handle. Missing registration costs $2,500 a day. Telemarketers register separately.
Sources: pub.njleg.state.nj.us/Bills/2026/PL26/25_.PDF · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54683 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54684
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF
International transfers
Section titled “International transfers”No cross-border transfer rules (federal rules are in us-federal). Processors must work under a binding contract. Since 30 June 2026, data brokers and businesses that supply them may not sell or license sensitive data to anyone.
Sources: pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF · pub.njleg.state.nj.us/Bills/2026/PL26/25_.PDF
Impact assessments
Section titled “Impact assessments”Before processing that presents a heightened risk, such as targeted advertising, sale, sensitive data or risky profiling, controllers must conduct and document a data protection assessment. The Division of Consumer Affairs can ask for it; it stays confidential.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54675
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling in furtherance of decisions with legal or similarly significant effects, and risky profiling needs a documented assessment. From 1 September 2027, the Kids Code bars using known under-18s’ personal data to rank or recommend content, except on listed bases such as their own settings, searches or express requests. We found no New Jersey AI law with duties for private businesses.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54673 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54675 · pub.njleg.state.nj.us/Bills/2026/A4500/4015_R3.PDF
Penalties
Section titled “Penalties”Only the Attorney General enforces the privacy law; its required 30-day cure notice ended on 1 July 2026. Violations breach the Consumer Fraud Act, with penalties up to $10,000 for a first offence and $20,000 for each later one, and $50,000 per record for selling sensitive data. The privacy law gives no private right of action. From 1 September 2027, a child or teen harmed by a Kids Code violation, or a parent or the AG for them, can sue for $5,000 per violation or treble damages, whichever is more, and punitive damages if it was reckless or knowing.
Sources: lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54680 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54682 · lis.njleg.state.nj.us/nxt/gateway.dll/statutes/1/54260/54482 · pub.njleg.state.nj.us/Bills/2026/PL26/25_.PDF · pub.njleg.state.nj.us/Bills/2026/A4500/4015_R3.PDF
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-nj.yaml.