On June 30, New Jersey Governor Mikie Sherrill signed A. 5328 (“the Act”) into law. The Act moved extremely quickly through the legislative process—it was introduced on June 28, then approved by the Assembly, Senate, and Governor a mere two days later. The law establishes a data broker registration regime in New Jersey (including a public registry) and imposes a broad prohibition on sales of sensitive data by data brokers, data collectors, and entities in New Jersey more generally. It also features significant registration fees and noncompliance penalties, such as a $50,000 penalty for each sensitive data record sale by a data broker or data collector.

The Act took effect immediately upon enactment, with a nine-month delay for establishment of the public data broker/data collector registry. However, the next several months will likely see additional developments with respect to the law’s enforcement. For example, a senior administration official for Governor Sherrill told a New Jersey news outlet that the administration “would not enforce the law until the legislature fixes certain defects that have come to light,” and the New Jersey Division of Consumer Affairs in the Department of Law and Public Safety (the “Division”), which is tasked with enforcing the law, published an alert on July 10 indicating that guidance clarifying the law’s requirements will be forthcoming in the coming months.

In this post, we summarize key elements from the Act for companies looking to understand their potential compliance obligations. To stay up to date on the latest developments in state privacy law, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.

Key Definitions

Similar to other state privacy laws and data broker laws, the Act defines key terms for regulated entities, regulated activities, and data types. These include:

• “Data broker” is defined as “a person or legal entity … that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses that data to a third party.” Sec. 2(a).
  • The law provides examples of direct relationships, including: (1) “customer, client, subscriber, or user of the person or legal entity’s goods or services”; (2) “employee, contractor, or agent of the person or legal entity”; (3) “investor in the person or legal entity”; or (4) “donor to the person or legal entity.” See 2(a).
• “Data collector” is defined as “a business, or units of a business, separately or together, that knowingly: (1) collect the personal data of a consumer with whom the data collector has a direct relationship; and (2) sell or license such personal data to a data broker.” Sec. 2(a).
• “Sale” is defined as “sharing, disclosing, or transferring personal data for monetary or other valuable consideration.” Sec. 2(a). Notably, this definition does not include the exceptions featured in the New Jersey comprehensive privacy law’s definition of “sale,” such as, for example, those for disclosures to an affiliate or for purposes of providing a product or service requested by the consumer.
• “Sensitive data” is defined (using the same definition as in New Jersey’s comprehensive privacy law) as “personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data.” Sec. 2(a).

Data Broker Registration

Following a similar format to state data broker laws in California, Oregon, Texas, Vermont, and Connecticut, the Act establishes a public registry for data brokers and data collectors that sell or license the personal data of New Jersey consumers (though the registry’s applicability to data collectors is a unique feature of the New Jersey law). Significantly, the Act departs from precedent state data broker laws by its hefty registration fees, as detailed below.

• Registration fee. The law’s data broker/data collector registration fee schedule is tiered based on the number of New Jersey residents’ personal data that a data broker or data collector sells or licenses. See 2(c)(2).  

• Registration disclosures. Data brokers and data collectors must disclose the following at the time of their registration: the entity’s name and physical address, email address, and website addresses; information about consumers’ ability to opt-out of the entity’s data collection practices; whether consumers may delete any personal data; any processors who process personal data on behalf of the entity; whether the entity uses a credentialing process for purchasers of data; a history of data breaches and cybersecurity events that have impacted the entity; and information about the entity’s data collection processes regarding persons under the age of 18. See 2(d).
• Public registry. The Act directs the Division to “establish and maintain a public registry of data brokers and data collectors engaged in selling or licensing personal data of New Jersey consumers.” See 2(b).

Prohibitions on Sales of Sensitive Data

The Act prohibits the sale of sensitive data not just by data brokers and data collectors, but also by entities operating in New Jersey more generally (the latter through an amendment to the state’s comprehensive privacy law).

• Restrictions on data brokers and data collectors. The Act prohibits data brokers and data collectors from selling or licensing sensitive data to any other individual or entity. See 3.
• Restrictions on New Jersey entities more broadly. In addition to its data broker/data collector-specific requirements, the Act also amends New Jersey’s comprehensive privacy law to prohibit the sale of sensitive data. Notably, this prohibition applies to all individuals and entities, “regardless of the number of consumers whose data the individual or entity controls or processes.” Sec. 1.

Exemptions

The Act includes many of the exemptions seen in other state privacy laws, including exemptions for, among other things, HIPAA PHI and GLBA-regulated data and entities. See, e.g., Sec. 2(g). The Act also exempts several activities for the purposes of its registration requirements (though not the provisions banning the sale of sensitive data), including developing a third-party e-commerce or application platform, providing 411 directory assistance, providing title and settlement services, and providing publicly available information for specified purposes (e.g., health and safety alerts, financial or real estate services, providing information related to an individual’s business or profession). See Secs. 2(e)–(f)

Enforcement

The Act took effect immediately, with the exception of the establishment of the data broker/data collector registry, which is delayed for about nine months. See Sec. 8. Compared to other state data broker laws, the Act imposes stronger civil penalties for noncompliance, including:

• Selling sensitive data. The Act provides for a civil penalty of $50,000 “for each [sensitive data] record sold, offered for sale, or licensed” by a data broker or data collector. See 5.
• Registration violations. Data brokers or data collectors who fail to register or submit the annual registration fee are liable, in addition to the outstanding fee, for a civil penalty of $2,500 for each day they fail to register or submit the registration fee. See 4(a).
• Failure to submit information. Data brokers or data collectors who fail to submit or update the information required to register with the state are liable for a civil penalty of $2,500 for each day they do not submit or update the required information. See 4(b).

Additionally, the Act grants rulemaking authority to the Division and directs it to adopt implementing rules and regulations. See Sec. 7.

What’s Next

As noted above, the Act took effect immediately, with the exception of the data broker/data collector registry requirements. The Division announced in its July 10 alert that it plans to launch the registry in spring 2027, with registration open from April to June 2027. The Division also indicated in that alert its intent to issue additional guidance “in the coming months” to clarify the Act’s requirements.

The law has already received significant criticism within New Jersey, with many companies and commentators criticizing the law’s speedy passage and onerous requirements. Potentially in response to this public pushback, the Sherrill administration has indicated that it will refrain from enforcing the law in the near term. For example, a July 10 article from the New Jersey Globe quoted an anonymous Sherrill administration official as confirming that “the state would not enforce the law until the legislature fixes certain defects that have come to light over the last few days.” It is currently unclear, however, what the administration’s longer-term posture will be with respect to enforcing this law.