New Jersey Adopts Sweeping New Data Broker Law, Effective Immediately
On June 30, 2026, Governor Mikie Sherrill signed A.5328 into law, making New Jersey the latest in a growing list of states to impose new requirements on businesses involved in the sale of consumer data. The New Jersey law is notable because of its novel breadth, its high registration fees and fines, and the fact that it took effect immediately. Any entity engaged in the sale of the personal data of New Jersey residents should review the new law to determine if its sweeping new requirements apply.
Broad New Requirements for Data Brokers and Data Collectors and Restrictions on Sensitive Data Sales
The law introduces two categories of requirements/restrictions, both of which have broad reach.
First, the law amends the existing comprehensive data privacy law in New Jersey to prohibit controllers from selling sensitive personal data, defined as “personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data.” The new law does not include a consent exception for this prohibition, and it notably applies irrespective of the underlying privacy law’s processing thresholds for applicability. This means that if a controller is not otherwise within scope of the New Jersey comprehensive data privacy law but sells the sensitive personal data of even one New Jersey resident, then it may be subject to this prohibition, absent any other exemption.
Second, the law establishes a new annual registration and fee regime not only for “data brokers” (i.e., entities that “knowingly collect[] or purchase[] the personal data of a consumer with whom the ... entity does not have a direct relationship and sell[] or license[] that data to a third party”), but also for “data collectors” (i.e., entities that “knowingly: (1) collect the personal data of a consumer with whom the data collector has a direct relationship; and (2) sell or license such personal data to a data broker”). In short, the new framework in New Jersey could be triggered by an entity that sells personal data, even if that entity has a direct relationship with the data subjects, if the data is sold to data brokers. In addition to registering and paying annual fees, data brokers and data collectors must disclose a variety of information as part of the registration process and are – like controllers – prohibited from selling sensitive data.
High Registration Fees and Penalties
Covered data brokers and data collectors are required to register and pay an annual fee that varies based on the volume of personal data collected, starting at $5,000 annually where the personal data of 100,000 consumers or fewer is involved, and reaching up to $1.5 million annually where the personal data of more than 4.5 million consumers is involved.
The law also establishes potentially significant consequences for noncompliance. For example, data brokers and data collectors that fail to register, fail to pay the required registration fee, or fail to timely update required registration information may be subject to civil penalties of up to $2,500 per day for each day of noncompliance. Data brokers, controllers, or data collectors that sell, offer for sale, or license sensitive data may be subject to a civil penalty of $50,000 per record.
Immediate Effective Date
The bulk of the new law took effect immediately upon enactment on June 30, 2026, leaving organizations with limited time to assess and address their compliance obligations. The effective date of only one provision has been delayed: the state’s requirement to establish and maintain a public registry of data brokers and data collectors. That requirement will take effect on March 27, 2027.
***
New Jersey’s new law is part of a growing trend of state regulation of data sales that continues to evolve rapidly, making it increasingly important for companies to monitor legislative developments and maintain a clear understanding of their data collection, sharing, and monetization practices.
Wiley’s Privacy, Cyber & Data Governance team has broad experience in navigating compliance issues around cutting-edge technology and the evolving legal landscape, and handling enforcement and litigation matters. For questions about this alert, please contact the authors.
