New Jersey Data Privacy Act (NJDPA), publicly available information exemption and biometric definition

N.J. Stat. §§ 56:8-166.4 et seq. (P.L. 2023, c. 266, S332)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 January 2025.

A personal data rule binding private bodies.

As of 29 August 2026.

What it requires

Personal data that is lawfully made available through a government record or widely distributed media, or that a consumer has not restricted to a specific audience, falls outside the NJDPA's definition of personal data.
The NJDPA's 25,000-consumer data-sale threshold has no percentage floor on how much of your revenue comes from selling personal data, unlike several peer states, so any revenue or in-kind discount from data sales can trigger it.
Treat scraped facial images processed into facial mapping, facial geometry, or a facial template as biometric data under this Act's own explicit definition, not merely as a photograph.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Personal data excludes de-identified data and publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes a consumer lawfully made available to the public and did not restrict to a specific audience, the ordinary exemption with no biometric carve-back.

The Act applies to a controller conducting business in New Jersey or targeting New Jersey residents that controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers where the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; notably, unlike several peer states, this second limb carries no percentage threshold on how much revenue must come from data sales, a lower bar than most comparable state acts.

Biometric data is defined unusually explicitly to include, but not be limited to, fingerprint, voiceprint, eye retinas, irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics used to identify a specific individual, naming facial mapping, geometry, and templates outright where several peer states' definitions stop at fingerprint and voiceprint, directly relevant to a scraper harvesting faces from public photos for facial-recognition purposes.

Approved January 16, 2024, effective on the 365th day following enactment, January 15, 2025, per the Act's own enactment clause. Enforcement is by the Division of Consumer Affairs in the Office of the Attorney General with sole and exclusive authority; the statute expressly creates no private right of action.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official enacted chapter text, New Jersey Legislature (pub.njleg.state.nj.us)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app