Law / United States / 
New Jersey
New Jersey Data Privacy Act, consumer rights and universal opt-out
N.J. Stat. §§ 56:8-166.4 to 56:8-166.19
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Give a New Jersey consumer a means to confirm, access, correct, delete, and port their personal data, and respond within 45 days of receipt (extendable once by 45 days).
- Recognize a user-selected universal opt-out mechanism for targeted advertising and sale of personal data. This duty became operative around , separately from NJDPA's general effective date.
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- Which user-selected universal opt-out mechanisms meet the criteria in section 8.b(2) of P.L. 2023, c. 266 so that a controller must honor them, when section 8.c leaves their technical specifications to Division rules and the Division's FAQs name Global Privacy Control only as one example?
What it makes you log
What the log must hold
Decision basis
Logging duty
The only record the rights provisions call for is the documented belief that an opt-out request is fraudulent, the ground for denying it; the controller must then send the requester a notice stating why. The act also lets a controller that obtained data from a source other than the consumer meet a deletion request either by keeping a record of the request and the minimum data needed to keep the data deleted, or by deleting the data; that is one of two routes and not a duty. The 45-day response, the written appeal answer and the universal opt-out mechanism are notice and process duties and name no log, period or reviewer. The documented data protection assessment (section 9) is carried by the general applicability row. The act reaches controllers that conduct business in the State or produce products or services targeted to its residents (section 2), and a consumer is defined as a resident (section 1).
- Kind
- Implicit
- As of
- Provision
- N.J.S.A. 56:8-166.4 et seq., P.L. 2023, c. 266, section 4(e) (a controller may deny an opt-out request only on a good faith, reasonable and documented belief that it is fraudulent, and must tell the requester why)
- Trigger
- consent_or_optout
What this law does
New Jersey consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials. A controller must act within 45 days of receipt, extendable once by 45 additional days, and must communicate a denial within 45 days with appeal instructions.
Beginning around (six months after the general effective date), a controller processing personal data for targeted advertising or sale must allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism, a staged duty confirmed directly from the Act's own text as distinct from the general effective date.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .