New Jersey’s New Data Broker Law Imposes Compliance Obligations on Entities That Provide Personal Data to Data Brokers, Prohibits the Sale of Sensitive Data

New Jersey became the latest state to enact legislation regulating data brokers –Assembly Bill 5328. In addition to regulating traditional data brokers, the law imposes obligations on “data collectors”—businesses that sell or license to data brokers the personal data of consumers with whom they have a direct relationship.

The New Jersey law is part of a broader push by both state and federal policymakers to regulate data brokers. At the state level, Connecticut and Vermont have recently imposed new requirements on data brokers. At the federal level, in February 2026, the Federal Trade Commission sent warning letters to 13 data brokers reminding them of their obligations under the Protecting Americans’ Data from Foreign Adversaries Act (PADFAA).

The New Jersey law’s prohibition on the sale of sensitive data is effective immediately. The law’s registration requirements will phase in over time: data brokers and data collectors will not be required to register or to pay any registration fees until the state’s public registry is established in the spring of 2027. The first registration period will be open from April 1, 2027, through June 30, 2027, and state authorities will issue additional guidance on how to register ahead of this period.

Data broker registration fees under the law may reach $1.5 million, and per-record penalties for sensitive‑data sales are set at $50,000.

Scope of the Law

The law applies to data brokers and data collectors.

• “Data brokers” are businesses that knowingly collect and sell or license to third parties the personal data of a consumer with whom the business does not have a direct relationship.
• “Data collectors” are businesses that have a direct relationship with consumers and sell or license those consumers’ personal data to data brokers. Examples of “direct relationships” include relationships with past or present customers, clients, subscribers, and users; employees, contractors, and agents; and investors or donors.

Exemptions

The law provides significant exemptions. Among other exemptions, the law does not apply to publicly available information; de-identified data; protected health information collected by a covered entity or business associate subject to HIPAA; personal data collected or sold in compliance with the FCRA; data, and institutions subject to the GLBA; and data used in human-subjects research under specified federal frameworks; and insurance institutions that handle data in connection with insurance transactions.

The law defines “publicly available information” broadly to include data made available from government records or widely distributed media, or data that a data broker or data collector has a reasonable basis to believe a consumer has lawfully made available to the general public and has not restricted to a specific audience.

Key Requirements

The law has two key requirements.

• Registration. Both data collectors and data brokers must register annually with the state. Registration fees range from $5,000 to $1.5 million. For data collectors, the amount of the fee is a function of the number of New Jersey consumers whose data they sell or license to data brokers. For data brokers, the fee amount will depend on the number of New Jersey consumers whose data they sell or license. Registered businesses will be listed on a registry published by the Division of Consumer Affairs in the Department of Law and Public Safety. Data brokers and data collectors will be required to provide extensive information as part of their registrations, including the privacy choices they offer to consumers generally and to users under 18, their procedures for vetting data purchasers, their history of data breaches and other cybersecurity incidents, a list of their service providers, and any other information the Division may require by regulation.
• Prohibition on sale of sensitive data. Effective immediately, the law prohibits data brokers and data collectors from selling sensitive data, regardless of consumer consent. “Sensitive data” is defined to include data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information; sex life or sexual orientation; citizenship or immigration status; and status as transgender or non-binary. The definition also covers genetic or biometric data that may be processed for the purpose of uniquely identifying an individual, personal data collected from a known child, and precise geolocation data.

The law defines “sale” to include any sharing, disclosure, or transfer of personal data for money or other valuable consideration.

Penalties

The law provides significant penalties.

• The law is enforced by the New Jersey Division of Consumer Affairs. It does not provide for a private right of action.
• Data brokers and data collectors that sell sensitive data in violation of the law are subject to a civil penalty of $50,000 per record. In addition, failure to register, pay the annual fee, or provide updated registration information carries a civil penalty of $2,500 per day for noncompliance. These fines are not capped.

Next Steps for Businesses

Because the law is already in effect, businesses should quickly review their practices to ensure compliance. Businesses should determine whether they constitute a data broker or data collector under the law and ensure that they currently comply with the prohibition on the sale of sensitive data.

Summer Associate Brendan Hyatt contributed to this alert.