New Jersey
For New Jersey, law name and abbreviation is New Jersey Data Privacy Act (NJDPA); effective date is January 15, 2025; consumer volume threshold is control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; threshold combination logic is OR — during a calendar year either threshold is met, recorded from its source on 2026-08-12.
- State
- New Jersey our reading
- Law name and abbreviation
- New Jersey Data Privacy Act (NJDPA)
- Effective date
- January 15, 2025
- Consumer volume threshold
- control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction verified
- Revenue-from-data-sales threshold
- control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data verified
- Threshold combination logic
- OR — during a calendar year either threshold is met verified
- Key exemptions
- HIPAA-covered entities and business associates; GLBA-regulated financial institutions and affiliates; secondary market institutions; insurance institutions; NJ Motor Vehicle Commission data sales under DPPA
- Enforcement mechanism
- Attorney General (Division of Consumer Affairs); violations treated as unlawful practices under the Consumer Fraud Act; no private right of action for data privacy violations specifically
- Statute citation
- N.J. Stat. Ann. § 56:8-166.1 et seq.
- Notes
- New Jersey is notable for not exempting nonprofit organizations — one of the few states where nonprofits must comply. Like Colorado, NJ does not specify a minimum percentage of revenue from data sales — any revenue or discount from selling data combined with 25,000+ consumers triggers the law.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
that during a calendar 44 year either: 45 a. control or process the personal data of at least 100,000 46 consumers, excluding personal data processed solely for the 47 purpose of completing a payment transaction; or S332 [5R] SINGLETON, CODEY 12 1 b. control or process the personal data of at least 25,000 2 consumers and the controller derives revenue, or receives a discount 3 on the price of any goods or services, from the sale of personal 4 data.
— pub.njleg.state.nj.us, retrieved 2026-08-12
Source
- pub.njleg.state.nj.ushttps://pub.njleg.state.nj.us/Bills/2022/S0500/332_R5.PDF