Law / United States / 
New Jersey
New Jersey Data Privacy Act, sensitive data and biometric definition
N.J. Stat. §§ 56:8-166.4 to 56:8-166.19
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Obtain a New Jersey consumer's opt-in consent before processing sensitive data, including biometric data, financial account information, or pregnancy-related health data.
- Treat facial mapping, facial geometry, or facial templates, or an identifier derived from a photograph, video, or audio recording to identify a specific individual, as NJDPA biometric data. New Jersey's definition claws this back rather than excluding it outright.
- Do not sell a New Jersey consumer's sensitive data, whatever the number of consumers whose data you control or process.
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- Is a facial template that a controller derives from a digital photograph 'biometric data' when the controller derives it to group photographs of the same face without naming anyone, given the exclusion for data generated from a photograph 'unless such data is generated to identify a specific individual'?
What it makes you log
Logging duty
The row covers the sensitive-data and biometric definitions (section 1) and the rule that sensitive data may be processed only with the consumer's consent (section 9(a)(4)). The consent must be obtained first, but the act does not say the controller must record or be able to show it, and it names no log. Processing sensitive data counts as heightened risk, so the documented data protection assessment of section 9(b) applies to it; that duty is carried by the general applicability row. The act reaches controllers that conduct business in the State or produce products or services targeted to its residents (section 2), and a consumer is defined as a resident (section 1).
- Kind
- None
- As of
What this law does
NJDPA's sensitive-data list is broader on two axes than most peer states: it names financial information (account number, login, or card number combined with a security code, access code, or password) as its own standalone sensitive category, and it names pregnancy explicitly within the health-condition prong, alongside racial or ethnic origin, religious beliefs, sex life or sexual orientation, citizenship or immigration status, transgender or nonbinary status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation.
"Biometric data" is defined to include fingerprint, voiceprint, retina or iris scan, and facial mapping, facial geometry, or facial templates specifically, the most explicit facial-recognition enumeration, excluding a bare photograph, video, or audio recording but clawing that exclusion back the moment data generated from one is used to identify a specific individual. Sensitive data may be processed only with the consumer's opt-in consent. P.L.2026, chapter 25 amended section 9 of the Act. A controller may not sell sensitive data, whatever the number of consumers whose data it controls or processes.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .