New Jersey’s New Data Privacy Rules: What Organizations Need to Know
What’s Happened?
If your organization buys, sells, or licenses consumers’ personal data, new rules in New Jersey may require you to register with the state and pay an annual registration fee. On June 30, 2026, New Jersey Governor Mikie Sherrill signed into law Bill A5328, a sweeping legislative framework amending the state’s existing data privacy law and establishing a new regulatory framework for data brokers and data collectors.
Why Does It Matter?
The new obligations imposed by the Act on “data brokers” and “data collectors” are stringent and costly. The new data collector category is broad, and organizations should immediately assess whether they fall under the new definitions.
Who Does This Apply To?
The Act introduces two new types of entities:
- A data broker is any person or entity that knowingly collects or purchases personal data about consumers with whom it has no direct relationship and then sells or licenses that data to third parties.
- A data collector is a business that does have a direct relationship with the consumer and knowingly collects that data to then sell or license it to a data broker.
A direct relationship can be with past or present (1) customers, (2) employees, (3) investors in the person or organization, or (4) donors.
What Are the New Obligations?
A5328 imposes onerous reporting requirements on newly defined data brokers and data collectors. They include, among others:
- Annual registration and registration fee – both data brokers and data collectors must register with the Division of Consumer Affairs in the Department of Law and Public Safety.
- To satisfy registration requirements, organizations must pay a tiered annual registration fee to the Division dependent on the number of New Jersey residents whose data they hold.
- 07/13/2026 Update: The DCA issued an alert that data brokers and data collectors will not be required to register or pay any fees until the DCA launches this registry in the spring of 2027.[1]
- The registration fee schedule is as follows:
| Consumers | Annual Fee |
| ≤100,000 | $5,000 |
| 100,001–499,999 | $10,000 |
| 500,000–999,999 | $100,000 |
| 1,000,000–1,499,999 | $500,000 |
| 1,500,000–2,499,999 | $750,000 |
| 2,500,000–4,499,999 | $1,000,000 |
| ≥4,500,000 | $1,500,000 |
- Disclosure requirements – upon registration, data brokers and data collectors must submit detailed disclosures, including:
- Basic contact details such as name, primary physical address, email, and website.
- How consumers can opt out of data sales including the method available, any limitations, and whether third parties can opt out on a consumer’s behalf.
- Whether consumers may direct deletion of their personal data.
- A statement identifying any data activities from which consumers cannot opt out.
- Information on how purchasers of data are vetted (if applicable).
- A history of data breaches and cybersecurity events, including the number of individuals affected.
- A separate statement on data practices relating to individuals under 18, including whether the organization has actual knowledge of possessing minors’ data.
- The identity of any processors processing data on the organization’s behalf.
- Complete prohibition on selling or licensing sensitive data – the Act imposes a complete ban on the selling or licensing of sensitive data. This applies to data brokers, data collectors, and data controllers alike, expanding existing State privacy legislation.
Are There Any Exemptions?
While the obligations imposed by the Act are broad, the regulatory framework continues to provide the same set of statutory exemptions as the existing New Jersey Data Protection Act. This includes federal healthcare privacy law (HIPAA), financial privacy law (Gramm-Leach-Bliley), credit reporting law (FCRA), and the Driver’s Privacy Protection Act. Research data, consumer reporting agencies, and state agencies are also exempt.
Additionally, certain narrow data broker activities fall outside of the Act’s scope, including: 411 directory assistance, publicly available business/professional information, real-time health or safety alerts, and nonprofit post-secondary enrollment data reporting.
What Happens If You Don’t Comply?
The Act introduces three new civil penalties enforceable via summary proceeding. A failure to register or pay the annual fee can result in a penalty of $2,500 per day in addition to the unpaid fees. A failure to submit or update the required disclosures can similarly result in a $2,500 per day penalty. Lastly, any unlawful sale, offer for sale, or licensing of sensitive data can result in a penalty of $50,000 per record.
Is Your Organization Ready? Steps To Take Now
While A5328’s obligations are effective immediately, a senior official of the governor’s office reportedly has stated that the governor will not enforce the Act until the legislature fixes “defects” in the law.[2] Additionally, on July 10, 2026, the DCA issued an alert that data brokers and data collectors will not be required to register or pay a registration fee until spring of 2027. Nevertheless, to strengthen readiness for compliance requirements, organizations should:
- Determine your status. Assess whether your organization qualifies as a data broker or data collector.
- Audit your data flows. Audit all existing data-sharing agreements, vendor contracts, and CRM export configurations to confirm none involve the transfer of sensitive data for consideration, including non-monetary consideration.
- Calculate your fee tier. Work out how many New Jersey residents’ records you hold. Note that regulatory guidance on counting methodology is pending.
- Identify your processors. Map all third parties that handle and process personal data on your behalf, as these must be disclosed. Review existing data licensing, sharing, and sale agreements for compliance with the sensitive data prohibition and opt-out disclosure requirements.
- Assess your exposure to minors’ data. Establish whether your organization has actual knowledge that it holds data relating to individuals under 18, as a separate disclosure will be required.
- Prepare your registry submission. Draft the required opt-out methodology, disclosure statements, and any statements identifying activities from which opt-out is not available.
Contact Us
A5328 represents a meaningful addition to New Jersey’s existing data privacy framework. If you have any questions about the Act and its potential implications for your organization, our team is here to help. Please reach out to the key contacts below.
The authors thank Summer Associate Denise Choi for assistance with the research and preparation of this blog post.
[1] https://www.njconsumeraffairs.gov/ocp/Pages/Alerts.aspx
To receive the latest insights on US legal developments, subscribe to the Freshfields A Fresh Take Blog.
