Law / United States / 
New Jersey
New Jersey Data Privacy Act, consumer rights and universal opt-out
N.J. Stat. §§ 56:8-166.4 to 56:8-166.19
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 January 2025.
A data subject rights rule binding private bodies.
As of 27 August 2026.
What it requires
- Give a New Jersey consumer a means to confirm, access, correct, delete, and port their personal data, and respond within 45 days of receipt (extendable once by 45 days).
- Recognize a user-selected universal opt-out mechanism for targeted advertising and sale of personal data. This duty became operative around July 15, 2025, separately from NJDPA's general effective date.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
New Jersey consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials. A controller must act within 45 days of receipt, extendable once by 45 additional days, and must communicate a denial within 45 days with appeal instructions.
Beginning around July 15, 2025 (six months after the general effective date), a controller processing personal data for targeted advertising or sale must allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism, a staged duty confirmed directly from the Act's own text as distinct from the general effective date.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisions
Read the law
official New Jersey session law text, P.L. 2023, c. 266, New Jersey Legislature
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.