New Jersey Data Privacy Act, Division of Consumer Affairs enforcement

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 January 2025.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

Expect NJDPA violations to be enforced exclusively by the Division of Consumer Affairs and the Attorney General under the Consumer Fraud Act, never by a private plaintiff.
Do not rely on a notice-and-cure opportunity before an enforcement action. New Jersey's cure window closed around July 15, 2026.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A violation of NJDPA is an unlawful practice and violation of the Consumer Fraud Act, N.J. Stat. § 56:8-1 et seq., enforced exclusively by the Division of Consumer Affairs and the Attorney General. Until the 18th month after the effective date (around July 15, 2026, now past as of the date shown), the Division was required to issue a notice of alleged noncompliance and a 30-day cure opportunity before bringing an action if a cure was deemed possible; that window has closed.

The Act expressly forecloses a private right of action under NJDPA itself or under any other law, including the Consumer Fraud Act's own separate private-action mechanism.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official New Jersey session law text, P.L. 2023, c. 266, New Jersey Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app