Law / United States / 
New Jersey
Data brokers and data collectors: no sale or licensing of sensitive data, with a civil penalty of $50,000 for each record
In force since .
A data brokers rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- If you are a data broker or a data collector, do not sell or license sensitive data to any other individual or entity (N.J.S.A. 56:8-166.22(a)).
- Treat as sensitive data any personal data revealing racial or ethnic origin, religious beliefs, health condition, treatment or diagnosis, financial account information with its access code, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric data processed to uniquely identify an individual, personal data collected from a known child, and precise geolocation data within a radius of 1,750 feet (N.J.S.A. 56:8-166.20(a) and 56:8-166.22(a)).
- Check whether an exclusion applies before relying on it: the ban does not reach Health Insurance Portability and Accountability Act (HIPAA) protected health information, Gramm-Leach-Bliley financial institutions, insurance institutions and insurance-support organizations, consumer reporting agencies acting under the Fair Credit Reporting Act, the Motor Vehicle Commission's sales that the Driver's Privacy Protection Act permits, State agencies and political subdivisions, human subjects research, and registered national securities associations (N.J.S.A. 56:8-166.22(b)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Section 5 of P.L.2026, c.25: a data broker, including a controller, or data collector that sells, offers for sale or licenses sensitive data in violation of section 3 or of section 9(a)(6) of P.L.2023, c.266 is liable for a civil penalty of $50,000 for each record sold, offered for sale or licensed.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
What record it asks for
Logging duty
Section 3 bars a data broker or data collector from selling or licensing sensitive data to anyone and exempts listed regulated data. It sets no log, record, retention period or audit, and names no one who may demand a record.
- Kind
- None
- As of
What this law does
A data broker or data collector may not sell or license sensitive data to any other individual or entity.
Sensitive data is personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, treatment or diagnosis, financial information, which includes an account number, account log-in or card number in combination with the code or password that permits access to the account, sex life or sexual orientation, citizenship or immigration status, status as transgender or non-binary, genetic or biometric data that may be processed to uniquely identify an individual, personal data collected from a known child, or precise geolocation data.
Precise geolocation data is information derived from technology that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet.
The sensitive data ban does not apply to Health Insurance Portability and Accountability Act (HIPAA) protected health information, a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act, a secondary market institution, an insurance institution subject to P.L.1985, c.179, the sale of sensitive data by the New Jersey Motor Vehicle Commission that the Driver's Privacy Protection Act permits, a consumer reporting agency acting as the Fair Credit Reporting Act authorizes, a State agency or political subdivision, human subjects research, an insurance-support organization, or a registered national securities association.
A data broker, including a controller, or a data collector that sells, offers for sale or licenses sensitive data in violation of section 3 of the act or of paragraph (6) of subsection a. of section 9 of P.L.2023, c.266 is liable for a civil penalty of $50,000 for each record sold, offered for sale or licensed. The provisions of the act apply in addition to, and not in lieu of, the provisions of P.L.2023, c.266. The act takes effect immediately and was approved on .
When LexLint raises it
When your app profile says your app processes personal data, processes biometric data or tracks devices.
Back to the example · Lint your app
Page updated .