CSG Law Alert: New Jersey Enacts Comprehensive Data Broker and Sensitive Data Amendments to the NJDPA
A new law imposing a blanket ban on the sale of sensitive personal data, the transmission of sensitive personal data by data brokers and data collectors, and a new data broker registration-and-disclosure compliance regime, recently expanded the scope of the New Jersey Data Privacy Act (NJDPA), potentially impacting numerous businesses that previously fell outside the NJDPA’s scope.
This month, New Jersey lawmakers enacted a new, game-changing privacy law that could ensnare unsuspecting businesses of all sizes that fail to take immediate action. A5328 (1R) (NJ Sensitive Data Law) amends the NJDPA to impose a blanket ban on the sale of sensitive data, a separate ban on the transmission of sensitive data by “data brokers” and “data collectors,” and a data broker registration-and-disclosure compliance regime – all backed by civil penalties for noncompliance.1
New Jersey Assembly Bill No. 5328 was introduced on June 28, 2026, passed both houses of the Legislature just two days later, and was signed into law by Governor Mikie Sherrill shortly thereafter, taking immediate effect.2 Although the law is effective now, its principal registration framework will not become operational until April 2027.
The statute, which regulates data brokers, data collectors, and the collection and dissemination of certain sensitive information, represents the second of two significant 2026 amendments to the NJDPA.3
At its core, A.B. 5328 establishes a statewide data broker registry. Data brokers and data collectors must annually register with the Division of Consumer Affairs and pay a fee based on the volume of consumer data they process. The law creates a seven-tier registration structure, with fees ranging from $5,000 to $1.5 million. Covered entities that fail to register or pay the applicable fee are subject to civil penalties of $2,500 per day.
As part of the registration process, covered entities must disclose extensive information, including:
- Their name and primary physical, email, and internet addresses;
- Whether consumers can opt out of data collection activities;
- Whether consumers may request deletion of their personal data;
- Activities for which no opt-out right is offered;
- Whether credential checks are conducted on data purchasers;
- Data breach and cybersecurity incident history;
- Practices relating to the personal data of individuals under 18 years of age;
- The processors used by the entity; and
- Any additional information the Division determines is necessary to implement the law.
1. Expanded Scope: Data Brokers and Data Collectors
Unlike most state data broker laws, A.B. 5328 regulates both “data brokers” and “data collectors.” Both categories encompass entities that sell or license personal data for use by brokers or third parties. The distinction is that a data collector maintains a direct relationship with the consumer from whom the data is obtained, while a data broker does not.
By adding the broader category of “data collectors,” the Legislature significantly expands the range of entities subject to the statute’s requirements.
2. New Compliance Obligations
The amendment also imposes several substantive obligations on data controllers, including requirements to:
- Limit the collection and processing of personal data to what is reasonably necessary for the disclosed purpose;
- Implement reasonable data security measures;
- Obtain consent where required for processing activities;
- Provide effective mechanisms for consumers to revoke consent;
- Clearly disclose processing purposes; and
- Conduct data protection assessments before engaging in processing activities that present a heightened risk of harm to consumers.
The law defines processing activities involving a heightened risk of harm to include targeted advertising, profiling, the sale of personal data, and the processing of sensitive data. The Division of Consumer Affairs has indicated that additional compliance guidance will be issued.
3. Important Carve-Out for Incidental Data Activities
Notwithstanding the broad definitions of data broker and data collector, the law contains an important limitation. An entity will not be treated as a data broker or data collector if its collection and disclosure of personal data is merely incidental to certain enumerated activities.3
For example, a title company that shares consumer information only as necessary to facilitate real estate closings would likely fall within the statute’s exemption for title and settlement services, provided the data-sharing activity remains incidental to that business function.
4. Blanket Ban on the Sale of Sensitive Data
Perhaps the most significant aspect of A.B. 5328 is its outright prohibition on the sale of sensitive data, regardless of consumer consent.
The statute defines sensitive data broadly to include information revealing an individual’s racial or ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, financial information, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric data used for identification, personal data collected from a known child, and precise geolocation information.
Each recorded sale, offer for sale, or license of sensitive data in violation of the law carries a civil penalty of $50,000.
5. Practical Impact
The enactment of A.B. 5328 significantly expands the reach of the NJDPA. Any person or entity – regardless of size or the volume of consumer data processed – that sells sensitive data may now violate the statute.
As a result, businesses that previously considered themselves outside the scope of the NJDPA because they did not meet the law’s general applicability thresholds should reassess their practices. In particular, organizations must determine whether they engage in the sale, licensing, or other monetization of information that qualifies as sensitive data under N.J.S.A. § 56:8-166.4.
Entities whose business models rely on the commercialization of sensitive personal information face the most immediate compliance risks. Enforcement remains exclusively with the New Jersey Attorney General, who may pursue remedies under the Consumer Fraud Act, including civil penalties, treble damages, and attorneys’ fees.
For more information on this law, please contact the authors of this alert or the CSG Law Tech, Privacy and Data Innovations Group. This alert was authored by Michelle A. Schaap with assistance from Ani Shahinian.
1 As with the NJDPA in effect prior to this new legislation, enforcement remains with the Attorney General; there is no private right of action for individuals.
2 New Jersey Division of Consumer Affairs, Office of Consumer Protection, Alerts (July 7, 2026). https://www.njconsumeraffairs.gov/ocp/Pages/Alerts.aspx
3 Assembly Bill No. 5017 (enacted January 20, 2026, as 2025 NJ Sess. Law Serv. Ch. 367), made broader definitional and exemption updates to the NJDPA, including an expanded definition of biometric data, additional entity-level exemptions and corrections to statutory cross-references.