New Jersey Data Broker Law 2026: What the Nation's Toughest Privacy Rules Mean for Your Data

Published: October 14, 2026 Category: Data Brokers, Privacy, Privacy Laws, Guide Reading time: ~12 minutes Meta description: New Jersey's data broker law (P.L.2026, c.25) is the toughest in the country. Here's who must register by April 2027, how the $5,000-$1.5 million fees work, and how to delete your data.

---

The New Jersey data broker law is the most aggressive privacy statute any U.S. state has passed — and most of the companies it covers still do not know it applies to them.

Signed by Governor Mikie Sherrill on June 30, 2026 as P.L.2026, c.25 (Assembly Bill A5328), the law rewrote the rules for anyone who buys, sells, or licenses personal information in the Garden State. It created the most expensive data broker registry in the country, with annual fees that climb from $5,000 to $1.5 million. It banned the sale of sensitive data outright, with no consent loophole. And it invented a new category — the "data collector" — that pulls ordinary businesses and even publishers into a regime they never expected to join.

The bill was introduced on June 28 and signed two days later, folded into the state budget rush. That speed is now causing the backlash: campaign data vendors say the fees could cost them millions, publishers are discovering they may be "data collectors," and trade groups are lobbying Trenton to repeal it. Yet the most important parts of the law are already live, and the registration deadline is closer than it looks.

This guide explains what the New Jersey data broker law actually does, the dates that matter, how it stacks up against California and Connecticut, and what you can do right now to get your own data out of the broker economy.

What Is the New Jersey Data Broker Law?

P.L.2026, c.25 is a package of amendments to New Jersey's comprehensive privacy law (the New Jersey Data Privacy Act, P.L.2023, c.266, in force since January 2025) that adds a dedicated data broker and data collector framework. It was sponsored by Assemblyman William F. Moen, Jr. and Senators John F. McKeon and Raj Mukherji.

The law does three big things at once:

1. It requires data brokers and "data collectors" to register annually with the New Jersey Division of Consumer Affairs and pay a tiered annual fee. 2. It bans the sale or licensing of "sensitive data" by controllers, data brokers, and data collectors — with no consent-based exception and no volume threshold. 3. It mandates public disclosures about what each registrant collects, how consumers can opt out, and whether their data has ever been breached.

What makes New Jersey different from the four states that already required broker registration — Vermont, Texas, Oregon, and California — is the combination of scope, fees, and penalties. New Jersey demands more information, charges far more money, and fines offenders more harshly than any state that came before it.

Who Has to Register: Data Brokers vs. Data Collectors

The law's two definitions decide who is covered, and the second one is the surprise.

• A "data broker" is a person or legal entity that knowingly collects or purchases the personal data of a consumer with whom it does not have a direct relationship, and then sells or licenses that data to a third party.
• A "data collector" is a business (or unit of a business) that knowingly collects personal data from a consumer with whom it does have a direct relationship — a customer, client, subscriber, user, employee, contractor, investor, or donor — and then sells or licenses that data to a data broker.

That second category is unique. New Jersey is the only state whose data broker law requires "data collectors" to register. In practice, it means a company that sells products to New Jersey residents and also sells or licenses that customer data to a broker now has to register, pay a fee, and make the same disclosures as a conventional broker.

There is no minimum threshold. As data privacy consultant Jodi Daniels (Red Clover Advisors) told AdExchanger, selling or licensing the data of even *one* New Jersey consumer to a broker is enough to bring a company into scope — and "sale" is defined broadly enough to capture many routine advertising-technology arrangements, even when no money changes hands.

That is why publishers are worried. Most assume a "data broker law" targets middlemen who trade data about strangers. New Jersey instead goes after the source. "Simply proclaiming 'We only use first-party data' is no longer an option," said Celine Guillou of the law firm Kelley Drye. "The real question is how data moves through the publisher's ecosystem."

Government entities — federal agencies, state agencies, and political subdivisions — are excluded from both definitions.

The Fee Table: The Highest Data Broker Fees in the Country

New Jersey's registration fees scale with how many New Jersey consumers' data a company sells or licenses each year. They are, by a wide margin, the steepest in the nation.

For context, California's data broker registration fee is roughly $6,000 a year, Connecticut's is $2,500, and Vermont's is $100. New Jersey's entry-level fee is already higher than California's, and its top tier is 250 times Vermont's.

The fee is not a one-time charge. It is annual, tied to the volume of New Jersey data a registrant handles, and it sits on top of the compliance work required to register in the first place.

New Jersey's Sensitive Data Sale Ban

Separately from the registry, the law amends New Jersey's privacy statute to prohibit controllers from selling sensitive data — and unlike many privacy statutes, there is no consent-based exception. The ban applies regardless of how many consumers an entity controls or processes.

"Sensitive data" under New Jersey law includes personal data revealing:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health condition, treatment, or diagnosis
• Certain financial information (account, log-in, or card numbers combined with a required security or access code or password)
• Sex life or sexual orientation
• Citizenship or immigration status
• Status as transgender or nonbinary
• Genetic or biometric data used to identify an individual
• Personal data collected from a known child
• Precise geolocation

This prohibition took effect the day the law was signed, on June 30, 2026, and remains in force — including while the rest of the registration machinery is still being built. Trade groups have asked the legislature to narrow the law, but the sensitive-data ban is not waiting for them.

The penalties are severe. A data broker, controller, or data collector that unlawfully sells, offers for sale, or licenses sensitive data is liable for a civil penalty of $50,000 per record. In a state with more than 6.7 million registered voters, that math is what has political data vendors talking about "millions" in exposure.

How the New Jersey Data Broker Law Handles Deletion and Opt-Out

For all the attention on fees, the New Jersey data broker law is also a consumer-rights statute, and its opt-out and deletion provisions are the part most people will actually use.

Under the registration rules, every covered broker and collector must disclose:

• Its name and physical, email, and website addresses
• How consumers can opt out of data collection — the method, the type, and whether a third party may opt out on an individual's behalf
• Any collection, database, or sales activity that a consumer cannot opt out of
• How consumers can request deletion of their data
• Any credentialing process for the businesses that buy their data
• A history of data breaches and cybersecurity events, including how many people were affected
• Their practices around the data of anyone under 18
• The data processors they rely on

That information goes into a public registry, which the Division of Consumer Affairs plans to launch in spring 2027. When it goes live, New Jersey residents will, for the first time, be able to look up a company and see — in the company's own words — whether it lets you opt out, how, and what it refuses to stop doing.

The individual rights come from New Jersey's underlying privacy law, which already lets residents access, correct, and delete their personal data, and opt out of the sale of their data and of targeted advertising. The new law sharpens those rights specifically against the broker and collector ecosystem. (For the mechanics of using a deletion right end to end, see our step-by-step guide to removing your personal information for free.)

Key Dates: What the New Jersey Data Broker Law Requires by 2027

The law took effect immediately on June 30, 2026 — but one piece was deliberately delayed.

New Jersey's Division of Consumer Affairs confirmed the timeline in a July 10, 2026 alert, noting that until the registry launches, covered brokers and collectors are not yet required to register or pay fees — but that the first window runs from April 1 through June 30, 2027, with guidance to follow. In other words: no fees today, a hard deadline next spring.

How New Jersey Compares to California and Connecticut

New Jersey is part of a wave — more than 20 states now have comprehensive privacy laws — but it sits at the aggressive end of it. Here is how the three most prominent data broker regimes line up.

California remains the only state with a single-request deletion platform — the Delete Act's DROP tool, which lets a resident file one verified request that every registered broker must honor. Connecticut became the first state to copy that model, phasing in a portal by 2028. New Jersey's law, by contrast, focuses on transparency and a public registry rather than a one-click deletion mechanism. (We covered Connecticut's version in our Connecticut data broker law guide.)

Each state's law is a different lever on the same problem. Our breakdown of 2026's privacy laws tracks the full landscape.

Why the New Jersey Data Broker Law Is Making Headlines

The law passed so fast — introduced June 28, signed June 30 — that entire industries are only now reading it. Two groups in particular are alarmed.

Political data vendors. Campaigns and the firms that supply their voter files may fall squarely inside the law. "It would cost us millions of dollars to have New Jersey on our voter file," Ashley Craig of Data Trust, a major Republican voter-data provider, told Campaigns & Elections. Paul Westcott, president of the data firm L2, said the registration fee is the biggest burden and that providers may have to weigh whether an entire state is worth keeping. The American Association of Political Consultants has asked New Jersey lawmakers to "repeal and replace" the measure.

Publishers and ordinary businesses. Because the "data collector" definition has no minimum threshold, any company with a direct customer relationship that shares or licenses that data onward to a broker is in scope. That includes news sites that monetize audience data through ad-tech arrangements. Many will not realize they qualify until they receive a registration reminder — or a penalty.

In July 2026, a senior official in Governor Sherrill's administration told the New Jersey Globe that the state planned to suspend enforcement pending legislative fixes, including the absence of an exemption for political and voter-targeting data. That promise is not the same as relief: the Division of Consumer Affairs has confirmed the April 2027 registration date, and the sensitive-data ban is already enforceable. As Kelley Drye's Guillou put it, companies are "better served by evaluating their data flows and assessing their exposure than by assuming the law will be narrowed or struck down."

The stakes are also rising nationally. In September 2026, the people-search broker Radaris lost its web domains after a court fight over ignored privacy requests — a warning that non-compliance has consequences beyond fines. (See our Radaris removal guide.) And California's privacy agency has begun fining brokers that failed to register under its own regime.

How to Remove Your Data from Data Brokers in New Jersey

You do not have to wait for the registry to open in 2027 — and you should not, because brokers rebuild profiles from public records continuously.

Here is what New Jersey residents can do right now:

1. Find out what is out there. Search your name on the major people-search sites and see how many profiles list your address, phone number, and relatives. Our guide to finding out what data brokers know about you walks through it. 2. Use your New Jersey privacy rights. As an NJ resident you can request deletion of your personal data from any covered controller. Brokers must honor verified requests. 3. File opt-outs directly. Every major broker — Spokeo, BeenVerified, Whitepages, Radaris, TruePeopleSearch, and dozens more — runs its own removal form. Our complete data broker opt-out list collects them in one place. 4. Automate the follow-up. Removal is not a one-time task; brokers re-list you. An automated service can re-file on your behalf month after month. CyberForget's free scan checks the major broker sites and tells you exactly where your information is exposed — at no cost.

If you want the full playbook, start with our complete guide to data broker removal, and for the underlying industry picture, read what a data broker actually is.

The Bottom Line

The New Jersey data broker law is the clearest sign yet that state-by-state regulation of the data broker industry has entered its enforcement era. It is the country's most expensive registry, the first to cover data collectors, and one of the first to ban sensitive-data sales outright — with penalties stiff enough to get an entire industry's attention.

For companies, the clock is running: registration opens April 1, 2027, the sensitive-data ban is already live, and the "data collector" definition reaches further than almost anyone assumed. For New Jersey residents, the news is simpler and better. Your data is worth less to brokers than it was yesterday, and you have new tools — and a coming public registry — to find out who has it and get it removed.

---

Sources:

• New Jersey Legislature — A5328 (P.L.2026, c.25), First Reprint
• New Jersey Division of Consumer Affairs — Alerts: Data Broker Legislation
• Hunton Andrews Kurth — New Jersey Adopts New Data Broker Registration Regime
• Regulatory Oversight — New Jersey Enacts the Nation's Costliest Data Broker Law Yet
• AdExchanger — What Publishers Don't Know About New Jersey's Data Broker Law Could Cost Them
• Campaigns & Elections — "It Would Cost Us Millions": New Jersey Law Has Political Data Brokers on Edge
• Krebs on Security — Data Broker Radaris Loses Domains in Privacy Fight

---

*This article is for informational purposes and does not constitute legal advice. New Jersey's law and its implementing regulations continue to develop; check the Division of Consumer Affairs for the latest guidance.*