# New Jersey — US state consumer data privacy laws: applicability thresholds by state

For New Jersey, law name and abbreviation is New Jersey Data Privacy Act (NJDPA); effective date is January 15, 2025; consumer volume threshold is control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; threshold combination logic is OR — during a calendar year either threshold is met, recorded from its source on 2026-08-12.

- **State:** New Jersey _(our reading, not quoted from the source)_
- **Law name and abbreviation:** New Jersey Data Privacy Act (NJDPA)
- **Effective date:** January 15, 2025
- **Consumer volume threshold:** control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — during a calendar year either threshold is met _(verified: appears in the quote below)_
- **Key exemptions:** HIPAA-covered entities and business associates; GLBA-regulated financial institutions and affiliates; secondary market institutions; insurance institutions; NJ Motor Vehicle Commission data sales under DPPA
- **Enforcement mechanism:** Attorney General (Division of Consumer Affairs); violations treated as unlawful practices under the Consumer Fraud Act; no private right of action for data privacy violations specifically
- **Statute citation:** N.J. Stat. Ann. § 56:8-166.1 et seq.
- **Notes:** New Jersey is notable for not exempting nonprofit organizations — one of the few states where nonprofits must comply. Like Colorado, NJ does not specify a minimum percentage of revenue from data sales — any revenue or discount from selling data combined with 25,000+ consumers triggers the law.

## What the source says

> that during a calendar 44 year either: 45 a. control or process the personal data of at least 100,000 46 consumers, excluding personal data processed solely for the 47 purpose of completing a payment transaction; or S332 [5R] SINGLETON, CODEY 12 1 b. control or process the personal data of at least 25,000 2 consumers and the controller derives revenue, or receives a discount 3 on the price of any goods or services, from the sale of personal 4 data.

## Source

- https://pub.njleg.state.nj.us/Bills/2022/S0500/332_R5.PDF

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).