New Jersey

A natural person commits a crime of the third degree if, without license or privilege, the person generates, creates, solicits, discloses, or uses a work of deceptive audio or visual media created substantially through technical means, commonly a deepfake, for the purpose of attempting or furthering the commission of an enumerated crime or offense, including sexual offenses, endangering the welfare of children under N.J.S. 2C:24-4, harassment, cyber-harassment, threats or improper influence in official and political matters, false public alarms, and hazing, or with knowledge that the work will be used by another for that purpose; knowingly or recklessly disclosing such a work, without more, is a crime of the fourth degree.

A fine of up to $30,000 may be imposed for a violation in addition to any prison term, and a victim may bring a civil action for actual or liquidated damages, punitive damages, and attorney's fees, without a criminal conviction as a prerequisite.

The Act exempts content a reasonable viewer would understand as criticism, comment, satire, parody, news reporting, teaching, scholarship or research, and exempts interactive computer service providers, cloud services providers, and AI developers or providers protected under 47 U.S.C. section 230.

Makes it unlawful, as a violation of the New Jersey Antitrust Act, for a rental property owner to pay for or use the services of a "coordinator," for a coordinator to facilitate a tacit or express pricing agreement among rental property owners including by performing a "coordinating function," for two or more persons to engage in parallel pricing coordination, or for any person to perform a coordinating function.

A "coordinating function" covers using an algorithmic device, other than a plain spreadsheet or an unprocessed-data database, to collect nonpublic, competitively sensitive rental data (prices, lease terms, occupancy) from two or more rental property owners and use it, including to train an algorithm, to set or recommend rental prices, lease terms, or occupancy levels for those owners.

Excluded are collecting such data solely for research, statistical analysis, or testing without using it to set prices, a publicly available free rent estimate, and a real-estate listing database available on equal terms that does not itself set or recommend prices. The Attorney General must establish a complaint intake channel and may adopt implementing rules. Signed by Governor Sherrill on July 20, 2026.

Final rules adopted by the New Jersey Division on Civil Rights under the Law Against Discrimination define an "automated employment decision tool" as any software, system, or process that aims to automate, aid, or replace human decision-making relevant to employment, including a tool that analyzes data to generate scores, rankings, predictions, classifications, or recommended actions used in advertising, recruiting, screening, interviewing, hiring, or compensation decisions.

The rules state that using such a tool that has not been adequately tested and shown not to adversely affect a protected class before its use, or that limits or screens out applicants based on a schedule requirement without an accommodation mechanism, may have an unlawful disparate impact; a named example is facial analysis technology used to assess personality traits in virtual interviews.

Where an employer's practice relies on an outside vendor's automated tool, the employer must take reasonable steps to ensure the vendor's tool is consistent with the Law Against Discrimination, so an employer cannot avoid liability by pointing to the vendor. The Law Against Discrimination's own definition of employer reaches both government and private employers, so this employment-scoped duty binds a covered New Jersey government employer the same as a private one.

This automated-tool-specific text is confirmed only for the employment subchapter; the rules' separate housing, real estate, and lending subchapter carries the same general disparate-impact framework but does not name automated decision tools specifically.

The New Jersey Identity Theft Prevention Act, a separate and older statute enacted as P.L. 2005, c. 226, took effect January 1, 2006, the first January 1 following its September 22, 2005 approval, per the act's own uncodified effective-date section (the breach-notification duty is not among the sections the act separately made effective immediately).

A business conducting business in New Jersey that compiles or maintains computerized records including personal information must disclose a breach of security to an affected New Jersey resident in the most expedient time possible and without unreasonable delay, with no fixed numeric-day deadline. A distinctive New Jersey feature requires reporting the breach to the Division of State Police in advance of notifying the customer.

NJDPA governs private-sector processing of New Jersey residents' personal data, enacted as P.L. 2023, c. 266 (S332), signed January 16, 2024. Its own uncodified section 17 sets the effective date at the 365th day following enactment, January 15, 2025.

A controller must limit collection of personal data to what is adequate, relevant, and reasonably necessary, the ordinary multi-state "reasonably necessary" standard rather than Maryland's stricter "strictly necessary" gate, and enforcement runs through the general Consumer Fraud Act framework.

New Jersey consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials. A controller must act within 45 days of receipt, extendable once by 45 additional days, and must communicate a denial within 45 days with appeal instructions.

Beginning around July 15, 2025 (six months after the general effective date), a controller processing personal data for targeted advertising or sale must allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism, a staged duty confirmed directly from the Act's own text as distinct from the general effective date.

A violation of NJDPA is an unlawful practice and violation of the Consumer Fraud Act, N.J. Stat. § 56:8-1 et seq., enforced exclusively by the Division of Consumer Affairs and the Attorney General. Until the 18th month after the effective date (around July 15, 2026, now past as of the date shown), the Division was required to issue a notice of alleged noncompliance and a 30-day cure opportunity before bringing an action if a cure was deemed possible; that window has closed.

The Act expressly forecloses a private right of action under NJDPA itself or under any other law, including the Consumer Fraud Act's own separate private-action mechanism.

NJDPA's sensitive-data list is broader on two axes than most peer states: it names financial information (account number, login, or card number combined with a security code, access code, or password) as its own standalone sensitive category, and it names pregnancy explicitly within the health-condition prong, alongside racial or ethnic origin, religious beliefs, sex life or sexual orientation, citizenship or immigration status, transgender or nonbinary status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation.

"Biometric data" is defined to include fingerprint, voiceprint, retina or iris scan, and facial mapping, facial geometry, or facial templates specifically, the most explicit facial-recognition enumeration, excluding a bare photograph, video, or audio recording but clawing that exclusion back the moment data generated from one is used to identify a specific individual.

Sensitive data may be processed only with the consumer's opt-in consent; New Jersey does not ban its sale outright the way Maryland does.

A person is guilty of computer criminal activity if the person purposely or knowingly and without authorization, or in excess of authorization, accesses data, a database, computer storage medium, computer program, software, equipment, a computer, computer system, or computer network, graded as a crime of the third degree for the general access offense.

N.J. Stat. section 2C:20-23(q) defines authorization objectively: permission, authority or consent given by a person who possesses lawful authority to grant it, and an actor has authorization if a reasonable person would believe that the act was authorized.

There is no separate statutory carve-out for publicly available data and no notice-based revocation concept anywhere in the definitions section, so the operative question for an open, unauthenticated page is whether a reasonable person encountering it, with no login wall, technical block, or other denial signal, would believe access was authorized, which tends to favor treating ordinary public-page crawling as authorized absent such a signal.

No reported New Jersey case applies this reasonable-person test to a scraping or public-page fact pattern; State v. Reid, 194 N.J. 386 (2008), the only related decision located, concerns a state-constitutional subpoena question arising from a stolen-credentials fact pattern and does not resolve the authorization element itself.

Section 4 of the founding act, P.L. 1984, c.184 (C.2C:20-25), was most recently revised by P.L. 2003, c.39 (effective 14 April 2003, per the NJ Division of Criminal Justice's own codification table), which expanded the offense's degree range from third to first and added the mandatory-minimum-sentence provision now at subsection g.; the objective reasonable-person authorization test in section 2C:20-23(q) is unchanged since then.

The Act defines a bot as an automated online account where all or substantially all of the actions or posts of that account are not directly generated by a live natural person, and prohibits using a bot to communicate or interact with a person in New Jersey, in connection with the sale or advertisement of merchandise or real estate, or to solicit election support, unless the person discloses at the outset of the communication or interaction, in clear and conspicuous fashion, that the communication or interaction is being conducted by or through a bot.

The Act does not impose a duty on a service provider of an online platform, including an Internet web hosting service provider or an Internet service provider, so the disclosure duty falls on the bot's operator, not the host. Civil penalties run $2,500 for a first offense, $5,000 for a second, and $10,000 for each subsequent offense, enforced by the Superior Court, with injunctive relief also available to the Attorney General.

This is a genuine automated-interaction-specific state law that none of the other jurisdictions researched carries: it does not regulate reading public pages, but it directly regulates deploying an automated account to interact with New Jersey residents.

Personal data excludes de-identified data and publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes a consumer lawfully made available to the public and did not restrict to a specific audience, the ordinary exemption with no biometric carve-back.

The Act applies to a controller conducting business in New Jersey or targeting New Jersey residents that controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers where the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; notably, unlike several peer states, this second limb carries no percentage threshold on how much revenue must come from data sales, a lower bar than most comparable state acts.

Biometric data is defined unusually explicitly to include, but not be limited to, fingerprint, voiceprint, eye retinas, irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics used to identify a specific individual, naming facial mapping, geometry, and templates outright where several peer states' definitions stop at fingerprint and voiceprint, directly relevant to a scraper harvesting faces from public photos for facial-recognition purposes.

Approved January 16, 2024, effective on the 365th day following enactment, January 15, 2025, per the Act's own enactment clause. Enforcement is by the Division of Consumer Affairs in the Office of the Attorney General with sole and exclusive authority; the statute expressly creates no private right of action.

A business or public entity must destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information, once the records are no longer retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable, undecipherable, or non-reconstructable through generally available means.

A willful, knowing, or reckless violation is deemed an unlawful practice and a violation of the Consumer Fraud Act, enforceable by the Attorney General for a civil penalty and injunctive relief, and actionable by a consumer for an ascertainable loss under the Consumer Fraud Act's private right of action, trebled with reasonable attorney's fees.

Requires a controller that has actual knowledge, or willfully disregards, that a consumer is at least 13 but younger than 17 years of age to obtain the consumer's own opt in consent before processing personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects, and treats personal data collected from a known child under 13 as sensitive data that must be processed in accordance with COPPA.