New Jersey Data Privacy Act, sensitive data and biometric definition

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 January 2025.

A sensitive categories rule binding private bodies.

As of 27 August 2026.

What it requires

Obtain a New Jersey consumer's opt-in consent before processing sensitive data, including biometric data, financial account information, or pregnancy-related health data.
Treat facial mapping, facial geometry, or facial templates, or an identifier derived from a photograph, video, or audio recording to identify a specific individual, as NJDPA biometric data. New Jersey's definition claws this back rather than excluding it outright.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

NJDPA's sensitive-data list is broader on two axes than most peer states: it names financial information (account number, login, or card number combined with a security code, access code, or password) as its own standalone sensitive category, and it names pregnancy explicitly within the health-condition prong, alongside racial or ethnic origin, religious beliefs, sex life or sexual orientation, citizenship or immigration status, transgender or nonbinary status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation.

"Biometric data" is defined to include fingerprint, voiceprint, retina or iris scan, and facial mapping, facial geometry, or facial templates specifically, the most explicit facial-recognition enumeration, excluding a bare photograph, video, or audio recording but clawing that exclusion back the moment data generated from one is used to identify a specific individual.

Sensitive data may be processed only with the consumer's opt-in consent; New Jersey does not ban its sale outright the way Maryland does.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Read the law

official New Jersey session law text, P.L. 2023, c. 266, New Jersey Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app