New Jersey Privacy Law

The New Jersey Data Privacy Act (NJDPA) was signed into law on January 16, 2024, and became effective on January 15, 2025. New Jersey's law is among the more consumer-friendly state privacy laws, requiring businesses to honor universal opt-out mechanisms and providing comprehensive consumer rights. The NJDPA grants New Jersey consumers the right to access, correct, delete, and obtain a portable copy of their personal data. Consumers also have the right to opt out of the sale of personal data, targeted advertising, and profiling. The law includes a robust appeals process and requires businesses to recognize Global Privacy Control (GPC) signals. New Jersey's law is notable for its broad definition of sensitive data and strong protections for minors. The law applies to entities conducting business in New Jersey or targeting New Jersey consumers that control or process personal data of 100,000 or more consumers (excluding payment transaction data), or control or process personal data of 25,000 or more consumers while deriving revenue from the sale of personal data. The NJDPA includes a 30-day cure period and penalties of up to $10,000 per violation for first offenses and $20,000 for subsequent violations, enforced by the New Jersey Attorney General.