Law / United States / 
New Jersey
Data broker and data collector registry: annual registration and fee, required disclosures, and a $2,500 daily penalty for failing to register
In force since .
A data brokers rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Licensing, Disclosure
- Audit expectation
- none
What it requires
- The Division of Consumer Affairs' duty to establish the public registry in section 2(b) is inoperative for 270 days following enactment on ; the rest of the act took effect on enactment (P.L.2026, c.25, section 8).
- If you are a data broker, meaning a person or entity that knowingly collects or purchases the personal data of a New Jersey consumer you have no direct relationship with and sells or licenses it to a third party, register with the Division of Consumer Affairs every year and pay the registration fee (N.J.S.A. 56:8-166.20(c)(1)).
- If you are a data collector, meaning a business that knowingly collects the personal data of consumers it has a direct relationship with and sells or licenses it to a data broker, register with the Division every year and pay the registration fee (N.J.S.A. 56:8-166.20(c)(1)).
- Pay a registration fee set by the number of New Jersey consumers whose personal data you sell or license, from $5,000 for 100,000 consumers or fewer up to $1,500,000 for more than 4.5 million (N.J.S.A. 56:8-166.20(c)(2)).
- Submit at registration, and update at least annually or as often as the Division requires, your name and primary physical, email and website addresses, whether and how people may opt out of or direct deletion of your data, the collection, databases and sales from which an individual cannot opt out, whether you credential purchasers, your history of data breaches and cybersecurity events and the number of people each affected, a separate statement on the personal data of people under 18, any other information the Division's regulations require, and the processors who process personal data for you (N.J.S.A. 56:8-166.20(d)).
- Check whether an exclusion applies before registering: the section does not reach Health Insurance Portability and Accountability Act (HIPAA) protected health information, Gramm-Leach-Bliley financial institutions, insurance institutions and insurance-support organizations, consumer reporting agencies acting under the Fair Credit Reporting Act, State agencies and political subdivisions, human subjects research, and registered national securities associations, and a sale that is incidental to an e-commerce or application platform, directory assistance, certain public-information services or regulated title services does not make you a data broker (N.J.S.A. 56:8-166.20(e) and (g)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Section 4 of P.L.2026, c.25: a data broker or data collector that fails to register or to submit the annual fee is liable for the registration fees for each year it failed to register and a civil penalty of $2,500 for each day it fails to do so, and one that fails to submit or update the information section 2(d) requires is liable for a civil penalty of $2,500 for each day. The Division collects and enforces a penalty in a summary proceeding under the Penalty Enforcement Law of 1999.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 2,500
Over one month of continuous breach, USD 76,100.
Who enforces it
Enforcement body
Division of Consumer Affairs in the Department of Law and Public Safety, which collects and enforces a civil penalty under section 4 in a summary proceeding before a court of competent jurisdiction under the Penalty Enforcement Law of 1999 (P.L.2026, c.25, section 4(c)).
What record it asks for
Logging duty
Section 2 requires an annual registration with the Division of Consumer Affairs and a submission of the data broker's or data collector's contact details, opt-out and deletion options, breach history, statement on the data of people under 18 and processors, updated at least annually. A registration submission is a filing with the Division, not a record the broker keeps, and no log, retention period or audit is named. Section 2(d)(6) asks for a history of data breaches, which is a disclosure to the Division and no duty to keep a record.
- Kind
- None
- As of
What this law does
A data broker is a person or legal entity, including a controller, that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses that data to a third party. A data collector is a business, or units of a business, that knowingly collects the personal data of a consumer with whom the data collector has a direct relationship and sells or licenses that personal data to a data broker.
A government entity, including a federal agency, a State agency and a political subdivision, is neither a data broker nor a data collector. Each data broker and data collector engaged in selling or licensing personal data of New Jersey consumers must register annually with the Division of Consumer Affairs and pay a registration fee.
The registration fee runs by tier from $5,000 for a data broker that sells or licenses the personal data of 100,000 consumers or fewer in the State to $1,500,000 for one that sells or licenses the personal data of more than 4.5 million consumers in the State. Each data broker and each data collector must submit prescribed information to the Division at the time of registration and update it at least annually, or at such other frequency as the Division may require.
A person is not a data broker or data collector if its sale or licensing of the data is incidental to developing or maintaining a third-party e-commerce or application platform, to 411 directory assistance for a telecommunications carrier, to providing publicly available information on an individual's business or profession or for financial or real estate services, to real-time health or safety alert services using publicly available information, or to title and settlement services regulated by the Department of Banking and Insurance, or if it is a nonprofit organization established to provide enrollment data reporting services for postsecondary educational institutions.
Section 2 does not apply to Health Insurance Portability and Accountability Act (HIPAA) protected health information, a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act, a secondary market institution, an insurance institution subject to P.L.1985, c.179, the sale of personal data by the New Jersey Motor Vehicle Commission that the Driver's Privacy Protection Act permits, a consumer reporting agency acting as the Fair Credit Reporting Act authorizes, a State agency or political subdivision, human subjects research, an insurance-support organization, or a registered national securities association.
A data broker or data collector that fails to register with the Division or to submit the annual registration fee is liable for the registration fees for each year it failed to register and a civil penalty of $2,500 for each day it fails to register or submit the required fee. A data broker or data collector that fails to submit or update the information required under section 2(d) is liable for a civil penalty of $2,500 for each day it fails to submit or update the information.
The Division collects and enforces a civil penalty under section 4 in a summary proceeding before a court of competent jurisdiction under the Penalty Enforcement Law of 1999. The Division of Consumer Affairs must maintain a public registry of data brokers and data collectors engaged in selling or licensing personal data of New Jersey consumers. The Director of the Division of Consumer Affairs must adopt the rules and regulations necessary for the implementation of the act.
Subsection b. of section 2, under which the Division establishes the public registry, remains inoperative for 270 days following the date of enactment. The act takes effect immediately and was approved on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .