New Jersey Enacts the Nation's Broadest Data Broker Law: What Your Business Should Know

New Jersey passed a data broker law (A.5328) that is in effect immediately and is more comprehensive than any similar state law passed to date. The law has two main parts, both with wide reach and significant consequences for noncompliance. Any company that sells personal data of New Jersey consumers should review this law to determine whether its requirements apply.

Part 1 – Prohibition on the Sale of Sensitive Personal Data

A.5328 prohibits the sale of New Jersey consumers’ sensitive personal data. “Sale” broadly includes sharing, disclosing, or transferring personal data for monetary or other valuable consideration. “Sensitive data” includes information concerning race or ethnicity, religious beliefs, health, financial accounts, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric identifiers, known children, and precise geolocation.

This prohibition does not include a consent exception and applies to any company that sells sensitive personal data of New Jersey consumers, even if the company does not meet the applicability thresholds under New Jersey’s general privacy law.

Selling, offering to sell, or licensing sensitive personal data may result in a civil penalty of $50,000 per record. Because personal data typically moves in high volumes, this could result in substantial penalties for noncompliance.

Part 2 – Annual Registration and Fees for Data Brokers and Data Collectors

Unlike other state data broker laws, New Jersey’s law creates a new category of entity—”data collectors”—separate from data brokers. Data collectors are entities that have a direct relationship with consumers but sell or license their personal data to a data broker.

Both data brokers and data collectors must register annually with the New Jersey Division of Consumer Affairs in the Department of Law and Public Safety and provide information about their data practices. Registration fees range from $5,000 to $1.5 million, depending on the number of consumers involved.

Failure to register, pay the registration fee, or provide, and maintain, required information may result in a civil penalty of $2,500 per day.

Below are questions to help you determine whether your company is a “data broker” or “data collector” under New Jersey law.

Is Your Company a “Data Broker” Under New Jersey Law?

Does your company knowingly collect or purchase personal data of New Jersey consumers?
Does your company sell or license that data to a third party?
Does your company have a direct relationship with the New Jersey consumers whose personal data it collects or purchases?

If you answered “yes” to the first two questions and “no” to the third, your company is likely a “data broker” and may be subject to the annual registration and fee requirements.

Is Your Company a “Data Collector” Under New Jersey Law?

Does your company knowingly collect personal data of New Jersey consumers?
Does your company sell or license that data to a data broker?
Does your company have a direct relationship with the New Jersey consumers whose personal data it collects or purchases?

If you answered “yes” to all three questions, your company is likely a “data collector” and may be subject to the annual registration and fee requirements.

What Businesses Should Do Now

Although the public registration requirements do not take effect until March 27, 2027, companies should assess now whether their practices involving the sale, licensing, or sharing of personal data may trigger the law. The potential penalties are significant, and New Jersey regulators are actively reviewing compliance across all sectors.

If your company has questions about whether this law applies to your business practices, the Coblentz Data Privacy & Cybersecurity team can help. Please contact Scott Hall or Meaghan Henderson for additional information or assistance.