New Jersey Enacted Data Broker Law in June 2026
The legislation mandates that companies collecting and selling consumer information register with the state.
Updated on Sept. 28, 2026 in Cybersecurity
Live Poll
Should companies that collect and share consumer data be required to join a public registry?
New Jersey enacted a data broker law in June 2026 that classifies businesses as data collectors if they share user information with brokers. The regulation mandates registration with the state for all qualifying entities, regardless of how much data is handled.
Why it matters
The law seeks to increase transparency and oversight for companies that monetize consumer data. By establishing a public registry, the state aims to better regulate how sensitive information like health and biometric records is bought and sold.
Registration fees are tiered based on the volume of New Jersey consumers affected, ranging from $5,000 for 100,000 or fewer people to $1.5 million for over 4.5 million individuals. Qualifying companies must provide their name, address, and opt-out procedures.
The players
New Jersey Legislature
This is the state governing body responsible for passing laws and addressing ongoing regulatory flaws identified within the data broker statute.
The details
Companies are defined as data collectors if they harvest consumer data to sell or license it, a category that extends to publishers who share data with brokers. A key provision already in effect since June 30, 2026, strictly prohibits the sale of sensitive health and biometric information.
Timeline
New Jersey enacted the data broker law in June 2026.
A ban on selling sensitive health and biometric data took effect on June 30, 2026.
The official registry for data collectors will open on April 1, 2027.
Companies must complete their state registration by April 2027.
The Tech Race
The New Jersey law follows a pattern set by the California Consumer Privacy Act by expanding state-level oversight of how private entities trade in personal digital information. This transition forces publishers and tech firms to align with fragmented state requirements rather than relying on a singular federal standard.
Residents can expect improved transparency as companies are now required to maintain accessible privacy and opt-out information in a public registry. Furthermore, the ban on selling sensitive biometric and health data adds a new layer of protection for personal information.
The takeaway
This law signals a shift toward stricter state-level control over the digital advertising and data brokering ecosystems. Companies operating in the state should prepare for administrative costs and operational changes to ensure they are compliant before the registration window closes.
What happens next
The state registry for data collectors is scheduled to officially open for business on April 1, 2027, with a final registration deadline for all qualifying companies set for April 2027.
Further reading
For additional context on the evolving regulatory environment, visit New Jersey Cybersecurity.
Source note: This article includes information reported by AdExchanger.
Live Poll
Should companies that collect and share consumer data be required to join a public registry?
