N.J. Comprehensive Privacy Law Takes Effect
New Jersey’s privacy law took effect Wednesday. It’s the 14th of 20 states with enforceable privacy laws and the fifth comprehensive state law to take effect this month, increasing companies’ risk (see 2501060066).
Sign up for a free preview to unlock the rest of this article
The New Jersey attorney general office’s consumer affairs division soon expected to open a rulemaking. Much remains unknown about that upcoming proceeding, though a state FAQ last updated Monday says that rules "will be forthcoming in 2025." The AG office didn’t comment Wednesday.
The state law applies to entities that operate in the state and control or process personal data of at least 100,000 consumers or control or process data of at least 25,000 consumers and derive any revenue or price discounts from selling personal data. Unlike most other states, New Jersey didn’t exempt nonprofits. Also uncommonly, New Jersey’s law includes financial information and transgender or nonbinary status as types of sensitive data. The AG will exclusively enforce the law, which has no private right of action. The law provides a 30-day right to cure that expires July 1, 2026.
“Given its massive population numbers, if you're controlling or processing the personal data of just over 1% of NJ's residents, you may fall into scope,” Porzio Bromberg attorney Alfred Brunetti warned Tuesday on LinkedIn. New Jersey “has never been shy about standing apart” and the New Jersey AG office has a reputation for “aggressively pursuing” consumer protection efforts, “even across state borders,” added Brunetti.
The AG office’s FAQ clarified some aspects of the law, but it’s not a binding document, privacy attorney Jana Farmer of Wilson Elser blogged Friday. “While at first blush the distinctions between the FAQ and [the New Jersey privacy law’s] definitions may not seem significant in practice, as the saying goes, the devil lurks in the details,” she said. “Note, for example, that personal data processed solely for the purpose of completing a payment transaction is exempted from the 100,000 consumers’ data threshold, and that receiving a discount on a price of any goods or services counts toward the ‘making money from personal data’ threshold.”
New Jersey was one of only three states to authorize rulemakings to implement its comprehensive privacy law. California and Colorado were the others.