New Jersey Data Privacy Law

Applicability model: Numerical threshold.

Core threshold: 100,000 consumers; or 25,000 consumers plus revenue/discount from sale of personal data

Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.

Sensitive-data standard: Consent required

Consent is required for targeted advertising, sale or qualifying profiling when the controller knows or willfully disregards that the consumer is 13–16.

Privacy notice, minimization, purpose limitation, security, sensitive-data consent, revocation, processor duties and assessments for heightened-risk processing.

Authority: New Jersey Office of the Attorney General / Division of Consumer Affairs

Private right of action: No

Penalty / remedy baseline: Up to $10,000 initial offense and $20,000 subsequent offenses under official FAQ

New Jersey combines a conventional threshold model with mandatory universal opt-out, strong 13–16 protections and an explicit rulemaking layer administered through the Division of Consumer Affairs.

The temporary mandatory 30-day cure period ran only through the first 18 months after effectiveness. Rulemaking must be tracked separately from the statute.

Editorial rule: future-effective, proposed and pending measures are kept separate from current law.