New Jersey’s Groundbreaking Law on Data Brokerage and Sensitive Data Protections
On June 30, 2026, New Jersey took a significant step forward in the realm of data privacy when Governor Mikie Sherrill signed into law A.5328, also known as “the Act.” This legislation introduces stringent regulations aimed at data brokers and data collectors, mandating annual registration, fee payments, and essential disclosures, while placing restrictions on the sale and licensing of sensitive data.
Immediate Implementation and Robust Framework
The Act came into effect immediately upon signing, highlighting New Jersey’s proactive approach to data privacy. However, certain provisions, particularly those requiring the New Jersey Division of Consumer Affairs to establish a public registry of covered data brokers, will not be operational for 270 days post-enactment. Just days later, on July 10, the Division announced an initial registration period slated for April 1 through June 30, 2027. They assured stakeholders that further guidance will be provided prior to the start of this registration period.
Defining Data Brokers and Collectors
Central to the Act are the defined roles of “data brokers” and “data collectors”:
- Data Brokers: These individuals or entities knowingly collect or purchase consumers’ personal data without a direct relationship to the consumer. They sell or license this data to third parties.
- Data Collectors: In contrast, these are typically businesses or divisions within businesses that collect personal data from consumers with whom they maintain a direct relationship. They sell or license this data to data brokers.
This distinction broadens the scope of entities affected by the law, encompassing not only traditional data brokers but also businesses that sell or license data obtained directly from consumers.
Registration and Fee Structure
The law outlines comprehensive registration requirements, involving not just an annual fee but also transparency measures regarding consumers’ data. Data brokers and collectors must disclose detailed information during the registration process, ensuring a heightened level of accountability.
The fee structure is tiered based on the number of New Jersey consumers whose data is involved. For example, the annual fee starts at $5,000 for entities dealing with 100,000 or fewer consumers. Fees escalate to a staggering $1.5 million for those handling data from over 4.5 million consumers. This tiered approach incentivizes compliance while ensuring that larger operations contribute more significantly to regulatory efforts.
Penalties for Noncompliance
New Jersey’s law does not take violations lightly. Data brokers and collectors who fail to register or pay the associated fees face significant penalties. Each failure to comply can lead to a civil penalty of $2,500 per day, coupled with liability for any unpaid registration fees from past years. Moreover, any illegal sale or licensing of sensitive data carries an eye-watering penalty of $50,000 per record. These punitive measures underscore the state’s determination to enforce compliance and protect consumer data.
Amendments to Existing Privacy Laws
In addition to introducing the registration regime, the law also amends New Jersey’s comprehensive privacy legislation. This amendment explicitly prohibits data controllers from selling sensitive data, which is meticulously defined. Sensitive data includes:
- Personal information revealing a person’s racial or ethnic origin
- Religious beliefs
- Mental or physical health conditions, treatments, or diagnoses
- Specific financial information
- Data concerning sex life or sexual orientation
- Citizenship or immigration status
- Gender identity or expression
- Genetic or biometric data used for unique identification
- Personal data collected from known children
- Precise geolocation data
Importantly, no consent-based exceptions are allowed within this prohibition. This blanket restriction applies universally to all individuals and organizations, regardless of the quantity of consumer data they handle.
This comprehensive approach reflects New Jersey’s commitment to safeguarding consumer privacy in an increasingly data-driven world. The implications of this law could resonate beyond state lines, potentially influencing broader discussions about data protection and consumer rights on a national scale.
With vigilant enforcement and a public registry in the works, New Jersey is firmly establishing itself as a leader in the fight for consumer privacy rights. The Act serves as a beacon for other states contemplating similar legislative action, emphasizing the pressing need for transparency and accountability in the data brokering industry.