What Is the NJDPA? New Jersey Data Privacy Act

The New Jersey Data Privacy Act (NJDPA) is New Jersey's comprehensive consumer data privacy law, codified at N.J.S.A. 56:8-166.4 et seq. It was enacted as Senate Bill S332, signed by Governor Phil Murphy on January 16, 2024, and took effect on January 15, 2025. It gives New Jersey residents the right to access, correct, delete, and port their personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling.

As of 2026, the New Jersey Attorney General and the Division of Consumer Affairs enforce the law under the New Jersey Consumer Fraud Act, with civil penalties of up to $10,000 for a first violation and $20,000 for each subsequent violation. The 30-day right to cure sunset on July 1, 2026, the first day of the 18th month following the law's January 15, 2025 effective date, so businesses can no longer count on a guaranteed cure window before an enforcement action.

Jurisdiction scope: This covers New Jersey's Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.). It is general legal information, not legal advice.

What the NJDPA is: statute, enactment, and effective date

The New Jersey Data Privacy Act is the state's first comprehensive consumer data privacy law. It is codified in Title 56 of the New Jersey Statutes, running from N.J.S.A. 56:8-166.4 through 56:8-166.19. The definitions that drive the rest of the law sit at N.J.S.A. 56:8-166.4.

The law was enacted as Senate Bill S332 and signed by Governor Phil Murphy on January 16, 2024, becoming P.L. 2023, c. 266. It then took effect on January 15, 2025, giving covered businesses roughly one year to build compliance programs before their obligations began.

As of 2026, the NJDPA is fully operative. Every controller that meets the applicability thresholds in N.J.S.A. 56:8-166.5 must honor consumer rights requests, respect opt-out signals, obtain consent before processing sensitive data, and maintain a compliant privacy notice. For the full set of controller and processor obligations, see the New Jersey data privacy laws parent page.

Who the NJDPA covers: the 100,000 and 25,000 thresholds

The applicability test lives in N.J.S.A. 56:8-166.5. The law applies to any controller that conducts business in New Jersey, or that produces products or services targeted to New Jersey residents, and that during a calendar year met either of two data thresholds.

The first trigger is controlling or processing the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction. That payment carve-out means a merchant does not count routine transaction-completion data toward the 100,000 figure.

The second trigger is controlling or processing the personal data of at least 25,000 consumers while the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data. New Jersey's "consumer" under N.J.S.A. 56:8-166.4 is a resident acting in an individual or household context, not in a commercial or employment context, so employee and business-to-business data generally does not count.

The revenue-or-discount trigger with no percentage floor

The second applicability prong is one of the NJDPA's most distinctive features. Many state privacy laws set their lower-headcount trigger at a fixed share of revenue, often 25 percent or 50 percent derived from selling personal data. New Jersey does not.

Under N.J.S.A. 56:8-166.5, a controller with 25,000 consumers is covered if it derives any revenue at all from the sale of personal data, or even if it merely receives a discount on the price of goods or services in exchange for that data. There is no percentage-of-revenue floor to clear.

This broadens the net considerably. A business that sells a modest amount of data, or that trades data for discounted services from a vendor, can be covered at 25,000 consumers even though the same business would escape a law that required selling data to be a meaningful share of its revenue. Companies should treat any data sale or data-for-discount arrangement as potentially triggering, not just a data-driven business model.

Financial information as sensitive data: an opt-in gate

Sensitive data sits at the center of the NJDPA because processing it requires opt-in consent. The definition at N.J.S.A. 56:8-166.4 is broad, and one inclusion sets New Jersey apart from most other states.

New Jersey treats financial information as sensitive data. The definition reaches a consumer's account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to the consumer's financial account. Most state privacy laws do not classify financial information as sensitive at all, so this is a meaningful expansion of the consent gate.

The definition also covers data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, sex life or sexual orientation, citizenship or immigration status, status as transgender or nonbinary, genetic or biometric data processed to identify an individual, personal data collected from a known child, and precise geolocation data. The express inclusion of transgender or nonbinary status, alongside financial information, makes New Jersey's sensitive-data category one of the broadest in the country.

Active rulemaking by the Division of Consumer Affairs

A second distinctive feature is that the NJDPA directs active administrative rulemaking. Most state privacy laws are enforced largely as written, with little or no formal regulatory build-out. New Jersey took a different path.

The Act directs the Director of the Division of Consumer Affairs, in the Department of Law and Public Safety, to adopt rules and regulations to effectuate the law. On June 2, 2025, the Division published proposed privacy regulations, opening a comment period that ran through August 1, 2025. The proposed rules address areas the statute leaves general, including detailed privacy-notice requirements, restrictions on dark patterns, symmetry-in-choice for consent, and limits on using personal data to train artificial intelligence without consent.

Because the rules can add detail beyond the statute, covered businesses cannot treat the statutory text as the final word. The regulatory layer is part of the compliance picture, and the NJDPA compliance checklist explains how to track it.

The 2026 amendment: new exemptions and an expanded de-identified-data definition

Governor Phil Murphy signed Assembly Bill A5017 into law on January 20, 2026 as P.L.2025, c.367, amending the NJDPA effective immediately. The amendment creates two genuinely new entity exemptions, for insurance-support organizations as defined in section 2 of P.L.1985, c.179 (N.J.S.A. 17:23A-2) and for national securities associations registered under Section 15A of the Securities Exchange Act of 1934. It also broadens two existing carve-outs: the HIPAA exemption now also reaches information treated like protected health information by a covered entity or business associate, where that information is used and disclosed in accordance with HIPAA and carries all of HIPAA's privacy protections and security safeguards, and the human-subjects research exemption adds research conducted under the good clinical practice guidelines of the International Council for Harmonisation, alongside the 45 C.F.R. Part 46 and 21 C.F.R. Parts 50 and 56 research already exempt in the original text.

The amendment also expands the NJDPA's de-identified-data definition to cover data de-identified in accordance with the requirements of 45 C.F.R. Part 164, the HIPAA de-identification standard, so long as any recipients of that data are contractually prohibited from attempting to re-identify it. Businesses relying on any of these categories should confirm their processing fits the amended exemption language rather than the original 2023 text.

Teen protections for 13-to-16 year olds

New Jersey adds a distinct teen protection that reaches further than older child-privacy frameworks. Under the Act, where a controller knows that a consumer is at least 13 and younger than 17, it must obtain consent before processing that consumer's personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

This consent requirement covers the 13-to-16 age band that the federal Children's Online Privacy Protection Act, which focuses on children under 13, does not reach. For teens in that band, opt-out is not enough: the controller needs affirmative consent for those three high-impact processing activities.

The teen consent rule operates alongside the children's-data protections. Personal data collected from a known child under 13 is itself sensitive data under N.J.S.A. 56:8-166.4, so processing it already requires consent.

NJDPA vs. CCPA: the key differences

Companies that operate nationally often compare New Jersey's NJDPA with California's law. The state data privacy law comparison page covers the broader multistate picture, but several differences from California's CCPA stand out.

The most consequential difference is the lower-tier trigger. New Jersey's 25,000-consumer prong with no percentage-of-revenue floor reaches businesses that California's 50-percent test would leave out. New Jersey also treats financial information as sensitive and requires opt-in consent for sensitive data, where California uses an opt-out right to limit. Both states route enforcement through state regulators, and neither the NJDPA nor the CCPA gives consumers a general private right of action for privacy violations.

Related guides

• New Jersey data privacy laws parent hub
• NJDPA consumer rights
• NJDPA compliance checklist
• State data privacy law comparison
• What is the CCPA?

More New Jersey Laws

• New Jersey Deepfake Laws
• New Jersey Employee Monitoring Laws
• New Jersey GPS Tracking Laws
• New Jersey Recording Laws

Frequently Asked Questions

What is the NJDPA?

The NJDPA, or New Jersey Data Privacy Act, is New Jersey's comprehensive consumer data privacy law codified at N.J.S.A. 56:8-166.4 et seq. It was enacted as Senate Bill S332, signed by Governor Phil Murphy on January 16, 2024, and took effect January 15, 2025. It gives New Jersey residents rights over their personal data and requires covered controllers to be transparent about how they collect, use, and disclose it.

When did the NJDPA take effect?

The NJDPA took effect on January 15, 2025. A controller must recognize a universal opt-out mechanism such as Global Privacy Control no later than six months after that date, by approximately July 15, 2025. The 30-day right to cure sunset on July 1, 2026, the first day of the 18th month after the effective date.

What are the NJDPA's coverage thresholds?

Under N.J.S.A. 56:8-166.5, the NJDPA covers any controller doing business in New Jersey or targeting New Jersey residents that, during a calendar year, controlled or processed the personal data of at least 100,000 consumers (excluding data used solely to complete a payment transaction), or of at least 25,000 consumers while deriving any revenue, or a discount on goods or services, from the sale of personal data. The second trigger has no percentage-of-revenue floor.

Does the NJDPA treat financial information as sensitive data?

Yes. Under N.J.S.A. 56:8-166.4, sensitive data includes financial information, defined as a consumer's account number, account log-in, financial account, or credit or debit card number in combination with any required security code, access code, or password that would permit access to the financial account. Most state privacy laws do not classify financial information as sensitive, so this is a distinctive feature, and processing sensitive data requires opt-in consent.

What counts as sensitive data under the NJDPA?

Under N.J.S.A. 56:8-166.4, sensitive data includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, financial information, sex life or sexual orientation, citizenship or immigration status, status as transgender or nonbinary, genetic or biometric data, personal data collected from a known child, and precise geolocation data. Processing any sensitive data requires the consumer's opt-in consent.

Does the NJDPA require recognizing a universal opt-out signal?

Yes. The NJDPA requires controllers to recognize a universal opt-out mechanism, such as Global Privacy Control, that lets consumers opt out of targeted advertising and the sale of their personal data through a browser or device setting. That obligation took effect no later than six months after the law's effective date, by approximately July 15, 2025.

How is the NJDPA different from the CCPA?

Key differences: New Jersey's lower-tier trigger of 25,000 consumers requires only any revenue or a discount from data sales, with no percentage floor, while California's lower trigger requires deriving 50 percent of revenue from selling or sharing data; New Jersey treats financial information as sensitive data subject to opt-in consent; California also treats a financial account, debit card, or credit card number combined with a required access code as sensitive personal information, but handles it with an opt-out right to limit rather than an opt-in requirement, consistent with the broader pattern that New Jersey uses an opt-in consent model for sensitive data while California uses an opt-out right to limit. Neither law gives consumers a general private right of action.

Who enforces the NJDPA?

The New Jersey Attorney General and the Division of Consumer Affairs enforce the NJDPA under the New Jersey Consumer Fraud Act. There is no private right of action. A violation can carry civil penalties of up to $10,000 for a first violation and $20,000 for each subsequent violation. A 30-day right to cure applied through June 30, 2026, but sunset on July 1, 2026, the first day of the 18th month after the effective date.