Law / United States / 
New Jersey
Identity Theft Prevention Act: limits on displaying, mailing and requiring Social Security numbers
Identity Theft Prevention Act, Social Security number limits, N.J. Stat. §§ 56:8-164 and 56:8-166
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Disclosure
As of .
What it requires
- Do not publicly post or publicly display an individual's Social Security number, or any four or more consecutive numbers taken from it (N.J.S.A. 56:8-164(a)(1)).
- Do not print an individual's Social Security number on materials mailed to the individual unless State or federal law requires the number on the document, and do not print it on a card the individual needs to access products or services you provide (N.J.S.A. 56:8-164(a)(2)-(3)).
- When a Social Security number is permitted in a mailed application or form, do not print it, in whole or in part, on a postcard or other mailer that needs no envelope, and do not let it be visible on the envelope or without opening the envelope (N.J.S.A. 56:8-164(d)).
- Do not intentionally communicate or otherwise make available to the general public an individual's Social Security number (N.J.S.A. 56:8-164(a)(4)).
- Do not require an individual to transmit his Social Security number over the Internet unless the connection is secure or the number is encrypted (N.J.S.A. 56:8-164(a)(5)).
- Do not require an individual to use his Social Security number to access an Internet web site unless a password, unique personal identification number or other authentication device is also required (N.J.S.A. 56:8-164(a)(6)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
A willful, knowing or reckless violation is an unlawful practice under the Consumer Fraud Act, P.L.1960, c.39 (C.56:8-1 et seq.); the Director of the Division of Consumer Affairs in the Department of Law and Public Safety adopts the implementing regulations.
What this law does
No person, including any public or private entity, may publicly post or publicly display an individual's Social Security number, or any four or more consecutive numbers taken from it. No person may print an individual's Social Security number on any materials mailed to the individual, unless State or federal law requires the number to be on the document, or on any card required for the individual to access products or services provided by the entity.
No person may intentionally communicate or otherwise make available to the general public an individual's Social Security number. No person may require an individual to transmit his Social Security number over the Internet unless the connection is secure or the number is encrypted, or to use the number to access an Internet web site unless a password, unique personal identification number or other authentication device is also required.
A public or private entity may use a Social Security number for internal verification and administrative purposes, so long as the use does not require the release of the number to persons not designated by the entity to perform associated functions allowed or authorized by law.
Social Security numbers may be included in applications and forms sent by mail, including documents sent to establish, amend or terminate an account, contract or policy, but may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or be visible on the envelope or without the envelope having been opened.
Section 13 of P.L.2005, c.226 does not prevent the collection, use or release of a Social Security number as required by State or federal law, and does not apply to documents that are recorded or required to be open to the public under Title 47 of the Revised Statutes. Section 15 of P.L.2005, c.226 makes it an unlawful practice and a violation of the Consumer Fraud Act to willfully, knowingly or recklessly violate sections 10 through 13 of the act.
P.L.2005, c.226 takes effect on January 1 next following enactment, except that section 3 takes effect immediately. P.L.2005, c.226 was approved on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.