New Jersey's data protection law for online businesses is the New Jersey Data Privacy Act (NJDPA), in force since 15 January 2025. It applies to businesses that process the data of 100,000 New Jersey consumers, or of 25,000 while earning anything from data sales, including nonprofits. Since 15 July 2025 they must honour opt-out signals such as Global Privacy Control, and the 30-day chance to cure a violation ended in July 2026.
What the New Jersey Data Privacy Act covers
The law was enacted as P.L. 2023, c. 266, and the New Jersey Division of Consumer Affairs calls it the New Jersey Data Privacy Law. It took effect on 15 January 2025 and grants New Jersey residents a broad set of rights over how businesses collect, use and share their personal data.
Unlike several other US state privacy laws, the NJDPA casts a wide net. According to the Division of Consumer Affairs' NJDPL FAQs, personal data includes examples such as a financial account number, login credentials and browsing history, and its list of sensitive data includes financial information and status as transgender or non-binary. The law also places specific obligations on how controllers handle data belonging to teenagers.
If your website attracts visitors from New Jersey, these requirements apply to how it collects data.
Who must comply: applicability thresholds
The NJDPA applies to any entity that conducts business in New Jersey or produces products or services targeted at New Jersey residents, and that meets at least one of two thresholds:
- Processes the personal data of at least 100,000 New Jersey consumers during a calendar year (excluding payment transaction data).
- Processes the personal data of at least 25,000 New Jersey consumers and derives revenue, or receives a discount on goods or services, from the sale of personal data.
There is no minimum revenue threshold. A small online retailer that tracks enough New Jersey visitors through analytics cookies such as _ga or advertising pixels like _fbp could meet the 100,000-consumer threshold without realising it.
The law excludes certain data, including health information protected by HIPAA, data processed under the Fair Credit Reporting Act, certain Motor Vehicle Commission data, and data collected by some financial and insurance institutions. Nonprofits are not exempt: the Division's FAQs say non-profits and small businesses must comply if they meet a threshold or act as processors.
Consumer rights under the NJDPA
New Jersey residents gain several rights that directly affect how your website handles personal data. These rights align broadly with other state laws.
Core rights
| Right | Description |
|---|---|
| Access | Confirm whether a controller processes their data and obtain a copy |
| Correction | Request correction of inaccurate personal data |
| Deletion | Request deletion of personal data provided by or obtained about the consumer |
| Portability | Obtain a copy of their data in a portable, readily usable format |
| Opt-out of sale | Opt out of the sale of personal data |
| Opt-out of targeted advertising | Opt out of processing for targeted advertising purposes |
| Opt-out of profiling | Opt out of profiling in decisions with legal or similarly significant effects, such as a loan, a job offer or an insurance policy |
Consumers can also use an authorised agent to opt out for them. The controller must grant that request if it can verify the consumer's identity and the agent's authority.
Universal opt-out signals are mandatory
Since 15 July 2025, controllers subject to the NJDPA must honour opt-out signals sent through universal opt-out mechanisms such as Global Privacy Control (GPC). In the Division's words, these mechanisms let consumers "automatically opt out of data processing across different websites, platforms, or devices".
The signal has to reflect the consumer's own choice. The NJDPA does not let a universal opt-out mechanism use a default setting that opts consumers in to processing, so a signal counts because the visitor turned it on, not because a tool set it for them.
For website owners already honouring GPC signals under Colorado or Connecticut law, the technical work is similar. Your consent management platform should detect the Sec-GPC HTTP header and stop advertising tags that sell or share data before they fire.
Financial information is sensitive data
The NJDPA defines sensitive data broadly. The Division lists racial or ethnic origin, religious beliefs, health condition, financial information, sexual activity or sexual orientation, immigration or citizenship status, status as transgender or non-binary, genetic or biometric data, precise geolocation data, and personal data collected from a known child.
Financial information stands out: Delaware's definition of sensitive data, for example, does not include it. Processing sensitive data requires the consumer's consent, and controllers must also complete a data protection assessment for it. For an e-commerce site, that means a form or tracking script that captures account numbers or card details needs a consent step, beyond what the payment itself requires.
You cannot rely on implied consent or pre-ticked checkboxes for sensitive data.
Minors and heightened protections
When a controller knows or wilfully disregards that a consumer is between 13 and 16, it must get the consumer's consent before processing their personal data, according to the Division's FAQs. For children under 13, the federal COPPA requirements apply, which means verifiable parental consent.
If your site could reasonably attract younger visitors, plan how you will identify them and keep advertising scripts from running until consent is given.
Data protection assessments
Controllers must conduct data protection assessments for processing activities that present a heightened risk of harm to consumers. The Division names three situations: a risk of unfair treatment, illegal discrimination or financial or physical injury, the sale of personal data, and the processing of sensitive data.
Each assessment must weigh the risks and benefits of the processing, taking into account the reasonable expectations of the consumer and the potential use of de-identified data. The assessments must be available to the New Jersey Attorney General on request, so treating them as a tick-box exercise is inadvisable.
If you operate in multiple US states, you can likely adapt existing assessments conducted under Colorado or Connecticut law, since the format and substance overlap considerably.
Enforcement, penalties and the end of the cure period
The New Jersey Attorney General holds exclusive enforcement authority. There is no private right of action, meaning consumers cannot sue businesses directly for NJDPA violations, though they can file complaints with the Division of Consumer Affairs.
The Attorney General may go to court to stop violations, seek compensation for consumers, and require the violator to pay up to $10,000 for an initial offence and $20,000 for later offences, the penalty scale of New Jersey's Consumer Fraud Act.
Until July 2026, the Division had to send a notice and give a controller 30 days to fix a curable violation before taking enforcement action. The Division's FAQs date the end of that window to 1 July 2026. Since then, the Attorney General can proceed to enforcement without offering a cure window.
The proposed regulations
The Division of Consumer Affairs proposed data privacy rules, a new chapter N.J.A.C. 13:45L, with a proposal date of 19 May 2025, and the comment period has closed. They cover areas such as how controllers should format privacy notices, handle consumer requests and document data protection assessments. As of October 2026, the Division's rule proposals page still lists them as a proposal, and its adoptions page shows no adoption.
How to prepare your website for the NJDPA
Start with a cookie audit. Identify every cookie, pixel and tracking script your site loads, including those set by third-party vendors. Categorise each one and determine whether it processes personal data of New Jersey residents.
Make sure your cookie banner presents a genuine choice. Visitors must be able to opt out of targeted advertising and data sale without encountering dark patterns or confusing interfaces. Supporting GPC signals alongside the banner is how you meet the universal opt-out requirement.
Review your privacy notice. It should state the categories of personal data processed, the purposes of processing, how consumers can exercise their rights, the categories of third parties with whom data is shared, and the categories of data shared with them.
If you process sensitive data or data from teenagers, set up opt-in consent flows. Block relevant scripts by default using your consent management platform's script-blocking functionality and only fire them after affirmative consent. For the regional setup across all the states you serve, see the global compliance overview.
New Jersey data privacy questions
When did the New Jersey Data Privacy Act take effect?
The NJDPA took effect on 15 January 2025. Controllers have had to honour universal opt-out mechanisms since 15 July 2025, and the mandatory 30-day cure period ended in July 2026.
Does the NJDPA apply to small businesses and nonprofits?
Yes, if they meet a threshold. There is no revenue test: any business or nonprofit that processes the personal data of 100,000 or more New Jersey consumers in a year, or of 25,000 while earning revenue or discounts from data sales, must comply.
Do I need to honour Global Privacy Control under New Jersey law?
Yes. Since 15 July 2025, controllers must honour opt-out signals sent through universal opt-out mechanisms such as Global Privacy Control, and the signal must reflect a choice the consumer made rather than a default.
What is the penalty for violating the NJDPA?
The Attorney General can go to court to stop violations, seek compensation for consumers, and require the violator to pay up to $10,000 for an initial offence and $20,000 for later offences.
Does the NJDPA cover financial data?
Yes. Financial information is sensitive data under the NJDPA, so processing it needs the consumer's consent and a data protection assessment.
Is there a private right of action under the NJDPA?
No. Only the New Jersey Attorney General has enforcement authority. Consumers cannot sue businesses directly for violations but may file complaints with the Division of Consumer Affairs.
See what New Jersey visitors' browsers receive
If you are not sure which cookies your site sets or whether they fall under the NJDPA, start with a free scan. Kukie.io finds and categorises every cookie, applies the consent model you set for each region, treats a GPC signal as an opt-out where you use an opt-out model, and keeps a record of each choice.
