July 16, 2026
New Jersey Assembly Bill 5328, enacted on June 30, 2026, and effective immediately, amends New Jersey's Data Privacy Law to imposes a ban on the sale of "sensitive data." This prohibition appears to apply to all controllers regardless of the number of consumers whose information is processed or the type of entity involved.
The legislation specifically provides that the prohibition against the sale or licensing of "sensitive data" applies "to all individuals or legal entities regardless of the number of consumers whose data the individual or entity controls or processes." "Sensitive data" means "personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer's account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer's financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data." The sale of sensitive data in violation of the ban can result in civil penalties of $50,000 for each record sold, offered for sale, or licensed.
In addition to the above, New Jersey now requires data brokers and data collectors to register and pay an annual fee ranging from $5,000 to $1.5 million, depending on the number of consumers involved. The New Jersey Division of Consumer Affairs has announced that it is delaying this registration requirement until Spring 2027 while it establishes a public registry. The Division also intends to issue additional guidance on the legislation in the coming months.
Under the legislation, "data broker" means "a person or legal entity, including, but not limited to, a controller, that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses that data to a third party." A third party does not include a processor if licensure or disclosure of personal data to the processor is solely to process the personal data on the data broker's or data controller's behalf. "Data collector" means "a business, or units of a business, separately or together, that knowingly: (1) collect the personal data of a consumer with whom the data collector has a direct relationship; and (2) sell or license such personal data to a data broker." Examples of a direct relationship include if the consumer is a past or present: (1) customer, client, subscriber, or user of the person or legal entity's goods or services; (2) employee, contractor, or agent of the person or legal entity; (3) investor in the person or legal entity; or (4) donor to the person or legal entity.
A person or entity that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses data to third parties is not considered a data broker or data collector if:
The data broker/data collector provisions include a number of other specific exemptions, including exemptions for: (1) protected health information regulated by the Health Insurance Portability and Accountability Act; (2) financial institutions and their affiliates subject to the Gramm-Leach-Bliley Act; (3) New Jersey insurance institutions; and (4) data collected, processed, or sold by consumer reporting agencies if the data is subject to and regulated by the Fair Credit Reporting Act.
Failure to register as a data broker or data collector may result in civil penalties of up to $2,500 per day, plus past fees owed.