New Jersey has enacted one of the broadest data broker regimes in the US, targeting businesses with new restrictions on sensitive personal data and introducing steep registration fees and penalties, prompting organisations to review their data practices now.
New Jersey has put one of the broadest state data broker regimes into force immediately, adding a new compliance burden for companies that buy, sell or licence consumer information. According to legal alerts from Wiley and other firms tracking the measure, Assembly Bill A.5328 was signed into law on June 30, 2026 and reaches beyond traditional data broker rules by also targeting businesses with direct relationships to consumers.
The law’s strictest feature is a near-total ban on the sale of sensitive personal data. That category is defined broadly and includes information about race or ethnicity, religion, health, financial accounts, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic and biometric identifiers, known children and precise geolocation. The restriction applies even where a consumer might otherwise have given consent, a point that sets the New Jersey regime apart from many existing privacy frameworks.
The statute also creates two registration classes: data brokers and a new category called data collectors. As described by Wiley and other law firms, data brokers are businesses that knowingly collect or purchase New Jersey consumers’ personal data and sell or licence it without having a direct relationship with those consumers. Data collectors are entities that do have a direct consumer relationship but still sell or licence personal data to a data broker. Both groups must register annually with the New Jersey Division of Consumer Affairs and disclose details about their data practices.
The fees are unusually steep. Legal analyses of the law say annual registration costs range from $5,000 to $1.5 million, depending on the number of consumers involved. Penalties are equally sharp: failing to register, pay the fee or keep required information current can trigger daily fines of $2,500, while unlawful sales of sensitive data can carry penalties of $50,000 per record.
Although the public registration regime does not begin until March 27, 2027, advisers say companies should review their data flows now. The law’s reach is wide enough that many organisations that do not think of themselves as data brokers may still fall within it if they monetise consumer data in any form. For firms handling New Jersey residents’ information, the immediate question is not whether the law is active, but whether their current practices could place them inside its scope.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
