New Jersey

A natural person commits a crime of the third degree if, without license or privilege, the person generates, creates, solicits, discloses, or uses a work of deceptive audio or visual media created substantially through technical means, commonly a deepfake, for the purpose of attempting or furthering the commission of an enumerated crime or offense, including sexual offenses, endangering the welfare of children under N.J.S. 2C:24-4, harassment, cyber-harassment, threats or improper influence in official and political matters, false public alarms, and hazing, or with knowledge that the work will be used by another for that purpose; knowingly or recklessly disclosing such a work, without more, is a crime of the fourth degree.

A fine of up to $30,000 may be imposed for a violation in addition to any prison term, and a victim may bring a civil action for actual or liquidated damages, punitive damages, and attorney's fees, without a criminal conviction as a prerequisite.

The Act exempts content a reasonable viewer would understand as criticism, comment, satire, parody, news reporting, teaching, scholarship or research, and exempts interactive computer service providers, cloud services providers, and AI developers or providers protected under 47 U.S.C. section 230.

Makes it unlawful, as a violation of the New Jersey Antitrust Act, for a rental property owner to pay for or use the services of a "coordinator," for a coordinator to facilitate a tacit or express pricing agreement among rental property owners including by performing a "coordinating function," for two or more persons to engage in parallel pricing coordination, or for any person to perform a coordinating function.

A "coordinating function" covers using an algorithmic device, other than a plain spreadsheet or an unprocessed-data database, to collect nonpublic, competitively sensitive rental data (prices, lease terms, occupancy) from two or more rental property owners and use it, including to train an algorithm, to set or recommend rental prices, lease terms, or occupancy levels for those owners.

Excluded are collecting such data solely for research, statistical analysis, or testing without using it to set prices, a publicly available free rent estimate, and a real-estate listing database available on equal terms that does not itself set or recommend prices. The Attorney General must establish a complaint intake channel and may adopt implementing rules. Signed by Governor Sherrill on July 20, 2026.

Final rules adopted by the New Jersey Division on Civil Rights under the Law Against Discrimination define an "automated employment decision tool" as any software, system, or process that aims to automate, aid, or replace human decision-making relevant to employment, including a tool that analyzes data to generate scores, rankings, predictions, classifications, or recommended actions used in advertising, recruiting, screening, interviewing, hiring, or compensation decisions.

The rules state that using such a tool that has not been adequately tested and shown not to adversely affect a protected class before its use, or that limits or screens out applicants based on a schedule requirement without an accommodation mechanism, may have an unlawful disparate impact; a named example is facial analysis technology used to assess personality traits in virtual interviews.

Where an employer's practice relies on an outside vendor's automated tool, the employer must take reasonable steps to ensure the vendor's tool is consistent with the Law Against Discrimination, so an employer cannot avoid liability by pointing to the vendor. The Law Against Discrimination's own definition of employer reaches both government and private employers, so this employment-scoped duty binds a covered New Jersey government employer the same as a private one.

This automated-tool-specific text is confirmed only for the employment subchapter; the rules' separate housing, real estate, and lending subchapter carries the same general disparate-impact framework but does not name automated decision tools specifically.

A person may not use an online bot to communicate or interact with a person in New Jersey in connection with the sale or advertisement of any merchandise or real estate, or to solicit support for any candidate, party or public question in an election, unless the person discloses at the outset of the communication or interaction, in clear and conspicuous fashion, that it is being conducted by or through a bot.

A bot is an automated online account where all or substantially all of the actions or posts of that account are not directly generated by a live natural person. A violator is liable for a civil penalty of $2,500 for the first offense, $5,000 for the second offense and $10,000 for each subsequent offense, collected in a summary proceeding under the Penalty Enforcement Law of 1999.

The Attorney General may also seek an injunction and recover the costs of investigation, the costs of the action and reasonable attorney fees. The law imposes no duty on the service provider of an online platform, including an Internet web hosting service provider or an Internet service provider. The law takes effect on the 180th day after the date of enactment. The Legislature records its approval of the act on January 21, 2020.

The New Jersey Identity Theft Prevention Act, a separate and older statute enacted as P.L. 2005, c. 226, took effect January 1, 2006, the first January 1 following its September 22, 2005 approval, per the act's own uncodified effective-date section (the breach-notification duty is not among the sections the act separately made effective immediately).

A business conducting business in New Jersey that compiles or maintains computerized records including personal information must disclose a breach of security to an affected New Jersey resident in the most expedient time possible and without unreasonable delay, with no fixed numeric-day deadline. A distinctive New Jersey feature requires reporting the breach to the Division of State Police in advance of notifying the customer.

NJDPA governs private-sector processing of New Jersey residents' personal data, enacted as P.L. 2023, c. 266 (S332), signed January 16, 2024. Its own uncodified section 17 sets the effective date at the 365th day following enactment, January 15, 2025.

A controller must limit collection of personal data to what is adequate, relevant, and reasonably necessary, the ordinary multi-state "reasonably necessary" standard rather than Maryland's stricter "strictly necessary" gate, and enforcement runs through the general Consumer Fraud Act framework.

New Jersey's Fair Price Protection Act, P.L.2026, chapter 55, was approved on July 23, 2026. Sections 1 to 7 of the act are codified at sections 56:8-23.1 to 56:8-23.7 of the New Jersey Statutes. The act may be cited as the Fair Price Protection Act. The act makes it an unlawful practice and a violation of P.L.1960, c.39 (C.56:8-1 et seq.) for a person to use the pricing strategies it names on groceries and other foodstuffs.

The pricing strategies the act names include any pricing strategy that determines or varies the sale price of groceries and other foodstuffs based, in whole or in part, on personal data.

Surveillance pricing includes a pricing strategy in which the price of groceries and other foodstuffs is determined, adjusted, optimized, or recommended by an algorithm or automated system, based, in whole or in part, on using personal data, including data derived, or inferred from other data, and that results in price variation for individual consumers or groups of consumers.

Surveillance pricing also includes the pricing of groceries and other foodstuffs based on data collected through electronic surveillance technology, which involves the use of technological methods, systems, or tools including, but not limited to, sensors, cameras, device tracking, biometric monitoring, and other forms of observation or data collection. The prohibition does not bar a person from offering a different price on groceries and other foodstuffs based upon one of three grounds.

One ground is reasonable costs associated with providing groceries and other foodstuffs to different consumers. Another ground is a bona fide discount whose eligibility conditions or criteria are conspicuously disclosed and uniformly offered based upon those conditions or criteria, and to which any member of a broadly defined group, including a group of teachers or veterans, is eligible.

A third ground is a bona fide discount offered as part of a loyalty program, including loyalty programs that allow the accrual or exchange of points, credits, or any similar nonmonetary system of value. To the extent a person employs personal data to offer a difference in price under those grounds, that personal data shall not be used for any other purpose without the consumer's consent.

The act does not apply to the pricing, advertisement, offer, or sale of food or beverages by an establishment primarily engaged in the preparation and sale of food or beverages for immediate consumption, whether consumed on or off the premises. Section 4 of the act sets a one-year moratorium on the new use of electronic shelf labels in the State.

The Attorney General may bring a civil action on behalf of the residents of the State in any court of competent jurisdiction to enjoin the act or practice and to enforce compliance with the act. The act takes effect on the first day of the 13th month next following the date of enactment, except that section 4 takes effect on the first day of the seventh month next following the date of enactment and section 5 takes effect immediately.

P.L.1985, c.179 establishes standards for the collection, use and disclosure of information gathered in connection with insurance transactions. In the case of life, health or disability insurance, the act applies to an insurance institution, agent or insurance-support organization that collects, receives or maintains information in connection with insurance transactions pertaining to natural persons who are residents of New Jersey.

No insurance institution, agent or insurance-support organization may use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure.

An insurance institution or agent must provide a notice of information practices to all applicants or policyholders in connection with insurance transactions. An insurance institution, agent or insurance-support organization must not use a disclosure authorization form unless it is written in plain language, is dated, and meets the other requirements of section 6.

On a written request from an individual after proper identification, an insurance institution, agent or insurance-support organization must within 30 business days inform the individual in writing of the nature and substance of the recorded personal information, permit the individual to see and copy it, disclose to whom it has been disclosed, and provide a summary of the procedure for requesting correction, amendment or deletion of recorded personal information.

On written request, an insurance institution, agent or insurance-support organization must correct, amend or delete the disputed recorded personal information, or notify the individual of its refusal, the reasons, and the individual's right to file a statement of disagreement.

In the event of an adverse underwriting decision, the insurance institution or agent responsible must either provide the specific reason or reasons in writing or advise that they may be requested in writing, and provide a summary of the individual's rights.

An insurance institution, agent or insurance-support organization may not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is one the section lists. Where a hearing results in a finding of a knowing violation of the act, the commissioner may order payment of a monetary penalty of not more than $500 for each violation, not to exceed $10,000 in the aggregate for multiple violations.

A person who violates a cease and desist order of the commissioner may, after notice and hearing, be subject to a monetary fine of not more than $10,000 for each violation, a fine of not more than $50,000 if the violations occurred with such frequency as to constitute a general business practice, or suspension or revocation of an insurance institution's or agent's license.

A person whose rights under sections 8, 9 or 10 are violated may apply to the Superior Court or any other court of competent jurisdiction for appropriate equitable relief. An insurance institution, agent or insurance-support organization that discloses information in violation of section 13 is liable for damages sustained by the individual about whom the information relates, and no individual is entitled to a monetary award exceeding actual damages.

Any person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is guilty of a crime of the fourth degree. P.L.1985, c.179 took effect 180 days after enactment. P.L.1985, c.179 was approved on June 10, 1985. The Department of Banking and Insurance states that the act took effect on December 7, 1985.

Section 3 of P.L.2003, c.41 (C.17:23A-13.3) bars an insurer or insurance producer from disclosing personal or privileged information collected or received in connection with an insurance transaction regarding an individual's status as a victim of domestic violence or a domestic violence-related condition, or as an employer of a victim of domestic violence, unless the disclosure falls within a listed exception. The 2003 act that added section 17:23A-13.3 was approved on April 14, 2003 and took effect immediately.

New Jersey consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials. A controller must act within 45 days of receipt, extendable once by 45 additional days, and must communicate a denial within 45 days with appeal instructions.

Beginning around July 15, 2025 (six months after the general effective date), a controller processing personal data for targeted advertising or sale must allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism, a staged duty confirmed directly from the Act's own text as distinct from the general effective date.

A violation of NJDPA is an unlawful practice and violation of the Consumer Fraud Act, N.J. Stat. § 56:8-1 et seq., enforced exclusively by the Division of Consumer Affairs and the Attorney General. Until the first day of the 18th month next following the effective date (July 1, 2026), the Division was required to issue a notice of alleged noncompliance and a 30-day cure opportunity before bringing an action if a cure was deemed possible.

The Act provides that nothing in it is to be construed as providing the basis for, or subject to, a private right of action for violations of the Act itself; the words "or under any other law" were struck by Assembly floor amendment before enactment, so the enacted text leaves a claim under another law, including the Consumer Fraud Act's own separate private-action mechanism, unaddressed.

No person, business or association may disclose or re-disclose on the Internet, or otherwise make available, the home address or unpublished home telephone number of a covered person once 10 business days have passed since it received written notice from an authorized person.

An authorized person invokes the prohibition by giving the person that discloses the information written notice that the sender is an authorized person, asking it to stop the disclosure and to remove the protected information from the Internet or wherever else it is made available.

A covered person is an active, formerly active or retired judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency or prosecutor, and any immediate family member residing in the same household. The term disclose includes making information available or viewable within a searchable list or database, whether or not a search of the list or database is actually performed.

The term person does not include the custodian of a government record. A person, business or association that violates the prohibition is liable to the covered person or the covered person's assignee, who may bring a civil action in the Superior Court.

The court shall award actual damages, but not less than liquidated damages computed at the rate of $1,000 for each violation, punitive damages on proof of willful or reckless disregard of the law, reasonable attorney's fees and litigation costs, and any other preliminary and equitable relief the court finds appropriate.

Daniel's Law, P.L.2020, c.125, took effect on its approval on November 20, 2020, except that its provisions on law enforcement officers became operative and enforceable 18 months later. Section 6 of P.L.2023, c.113, which rewrote the prohibition, took effect with that act, while its sections 1 through 5 and 7 remained inoperative until the first day of the 13th month after enactment.

Sections 1 through 10 of P.L.1996, c.126 are known as the Genetic Privacy Act. No person may obtain genetic information from an individual, or from an individual's DNA sample, without first obtaining informed consent from the individual or the individual's representative.

The consent requirement does not apply to genetic information obtained by a law enforcement agency to establish identity in a criminal investigation or prosecution, to determine paternity, under the DNA Database and Databank Act of 1994, to identify deceased individuals, for anonymous research where the subject's identity will not be released, under newborn screening requirements, or as federal law authorizes for the identification of persons.

No person may retain an individual's genetic information without first obtaining authorization under the informed consent requirement, unless retention falls within one of five listed exceptions.

A DNA sample from which genetic information has been obtained must be destroyed promptly on the specific request of the individual or the individual's representative, unless retention is necessary for a criminal or death investigation or a criminal or juvenile proceeding, or is authorized by court order.

An individual or the individual's representative, promptly on request, may inspect, request correction of and obtain genetic information from the individual's records unless the individual directs otherwise by informed consent, except that for a policy of life insurance or a disability income insurance contract the provisions of P.L.1985, c.179 apply.

A person may not disclose, or be compelled by subpoena or any other means to disclose, the identity of an individual on whom a genetic test has been performed, or genetic information about the individual in a manner that permits identification, unless one of ten listed conditions is met.

A person who requires or requests that genetic testing be done, or receives records, results or findings of genetic testing, must give the person tested notice that the test was performed and that the records, results or findings were received, unless otherwise directed by informed consent. A person violating sections 6 through 9 of P.L.1996, c.126 is a disorderly person punishable by a fine of $1,000, a prison term of six months, or both.

A person who willfully discloses an individual's genetic information to a third party in violation of the act is punishable by a fine of $5,000, a prison term of one year, or both. A person who discloses an individual's genetic information in violation of the act is liable to the individual for all actual damages, including damages for economic, bodily or emotional harm proximately caused by the disclosure.

Sections 6 and 7 of P.L.1996, c.126 apply to genetic information obtained on or after the act's effective date. P.L.1996, c.126 was approved on November 19, 1996 and took effect immediately.

No person, including any public or private entity, may publicly post or publicly display an individual's Social Security number, or any four or more consecutive numbers taken from it. No person may print an individual's Social Security number on any materials mailed to the individual, unless State or federal law requires the number to be on the document, or on any card required for the individual to access products or services provided by the entity.

No person may intentionally communicate or otherwise make available to the general public an individual's Social Security number. No person may require an individual to transmit his Social Security number over the Internet unless the connection is secure or the number is encrypted, or to use the number to access an Internet web site unless a password, unique personal identification number or other authentication device is also required.

A public or private entity may use a Social Security number for internal verification and administrative purposes, so long as the use does not require the release of the number to persons not designated by the entity to perform associated functions allowed or authorized by law.

Social Security numbers may be included in applications and forms sent by mail, including documents sent to establish, amend or terminate an account, contract or policy, but may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or be visible on the envelope or without the envelope having been opened.

Section 13 of P.L.2005, c.226 does not prevent the collection, use or release of a Social Security number as required by State or federal law, and does not apply to documents that are recorded or required to be open to the public under Title 47 of the Revised Statutes. Section 15 of P.L.2005, c.226 makes it an unlawful practice and a violation of the Consumer Fraud Act to willfully, knowingly or recklessly violate sections 10 through 13 of the act.

P.L.2005, c.226 takes effect on January 1 next following enactment, except that section 3 takes effect immediately. P.L.2005, c.226 was approved on September 22, 2005.

Section 3 of P.L.1996, c.126 amended N.J.S.17B:30-12. No person may discriminate against an individual on the basis of genetic information, or the refusal to submit to a genetic test or make available its results, in the issuance, withholding, extension or renewal of hospital confinement or other supplemental limited benefit insurance, or in fixing its rates, terms or conditions.

No person may make or permit any unfair discrimination against an individual in the application of the results of a genetic test or genetic information in the issuance, withholding, extension or renewal of a policy of life insurance, including credit life insurance, an annuity, a disability income insurance contract or credit accident insurance coverage.

An insurer that will use the results of a genetic test in issuing, withholding, extending or renewing life, annuity, disability income or credit accident coverage must notify the individual that the test will be required and obtain the individual's written informed consent before the test is administered.

The insurer must also provide that the physician or other health care professional designated by the individual promptly receives a copy of the test results, and that the individual states in writing whether the individual elects to be informed of the results.

If the commissioner has reason to believe that such unfair discrimination has occurred and that a proceeding would be in the public interest, the commissioner must issue a statement of charges, and on a determination of a violation must order the insurer to cease and desist and may order payment of a penalty consistent with N.J.S.17B:30-1 et seq. P.L.1996, c.126 was approved on November 19, 1996 and took effect immediately.

It is an unlawful employment practice for an employer, because of an individual's genetic information, or because the individual refuses to submit to a genetic test or to make available the results of a genetic test to the employer, to refuse to hire or employ, to bar or discharge, or to discriminate against the individual in compensation or in terms, conditions or privileges of employment.

Genetic information means the information about genes, gene products or inherited characteristics that may derive from an individual or family member. A genetic test is a test for determining the presence or absence of an inherited genetic characteristic in an individual, including tests of nucleic acids such as DNA, RNA and mitochondrial DNA, chromosomes or proteins in order to identify a predisposing genetic characteristic.

Employer includes all persons unless otherwise specifically exempt under another section of the Law Against Discrimination, and includes the State, any political or civil subdivision thereof, and all public officers, agencies, boards or bodies. Section 5 of P.L.1996, c.126 amended section 11 of P.L.1945, c.169 (C.10:5-12), which lists genetic information among the protected grounds.

A person who violates the Law Against Discrimination is liable, in addition to any other relief, for a penalty not exceeding $10,000 if the respondent has no adjudged prior violation within five years, $25,000 if it has one other adjudged violation within five years, and $50,000 if it has two or more adjudged violations within seven years, determined by the director in an order following a finding of an unlawful employment practice.

P.L.2001, c.254 amended section 2 of P.L.1983, c.412 (C.10:5-14.1a), the penalty section of the Law Against Discrimination. P.L.2001, c.254 was approved on November 15, 2001 and took effect immediately. P.L.1996, c.126 was approved on November 19, 1996 and took effect immediately.

NJDPA's sensitive-data list is broader on two axes than most peer states: it names financial information (account number, login, or card number combined with a security code, access code, or password) as its own standalone sensitive category, and it names pregnancy explicitly within the health-condition prong, alongside racial or ethnic origin, religious beliefs, sex life or sexual orientation, citizenship or immigration status, transgender or nonbinary status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation.

"Biometric data" is defined to include fingerprint, voiceprint, retina or iris scan, and facial mapping, facial geometry, or facial templates specifically, the most explicit facial-recognition enumeration, excluding a bare photograph, video, or audio recording but clawing that exclusion back the moment data generated from one is used to identify a specific individual. Sensitive data may be processed only with the consumer's opt-in consent. P.L.2026, chapter 25 amended section 9 of the Act. A controller may not sell sensitive data, whatever the number of consumers whose data it controls or processes.

An operator is the operator of an online education service with actual knowledge that the service is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes. An online education service is an Internet website, online service, online computer application or mobile application that is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes.

P.L.2019, c.494 does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's website, service or application may be used to access them. An operator may not knowingly use information created or gathered by its service to amass a profile about a student for any purpose other than K-12 school purposes.

An operator may not knowingly sell or rent a student's information, including covered information. An operator may not knowingly disclose covered information unless the disclosure falls within one of the exceptions the section lists.

An operator may not knowingly engage in targeted advertising on its service, or on any other Internet website, online service, online computer application or mobile application if the targeted advertising is based on information its service acquired because of the use of the service for K-12 school purposes.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification or disclosure.

An operator must delete covered information at the request of a K-12 school or a school district overseeing the student's education through the service, or of a student who has reached the age of majority, unless the student, parent or guardian requests that the operator maintain it. Section 6 of P.L.2019, c.494 makes it an unlawful practice under the Consumer Fraud Act for an operator of an online education service to violate the act or any rule adopted under it.

P.L.2019, c.494 takes effect immediately but remains inoperative for 180 days following the date of enactment. P.L.2019, c.494 was approved on January 21, 2020. No source located states the day on which the 180-day inoperative period ended.

A person is guilty of computer criminal activity if the person purposely or knowingly and without authorization, or in excess of authorization, accesses any data, data base, computer storage medium, computer program, computer software, computer equipment, computer, computer system or computer network, a crime of the third degree.

Separate subsections punish altering, damaging or destroying data or denying, disrupting or impairing computer services, and obtaining, taking, copying or using data stored in a computer.

A violation of any subsection is a crime of the first degree if the offense results in a substantial interruption or impairment of public communication, transportation, supply of water, gas or power, or other public service, in damages or loss in excess of $250,000, or in significant bodily injury, and every sentence of imprisonment for a first-degree violation includes a minimum term of one-third to one-half of the sentence imposed.

N.J.S.A. 2C:20-23(q) defines authorization as permission, authority or consent given by a person who possesses lawful authority to grant it, and adds that an actor has authorization if a reasonable person would believe that the act was authorized.

The definition adds an objective question, so for an open, unauthenticated page with no login wall, technical block or other denial signal in front of it, the operative question is whether a reasonable person would believe access was authorized, which favors treating ordinary public-page crawling as authorized absent such a signal.

P.L. 2003, c. 39, approved April 14, 2003 and effective immediately, amended section 2 of P.L.1984, c.184 (C.2C:20-23), which contains the definition of authorization, and section 4 of P.L.1984, c.184 (C.2C:20-25), which defines the offense.

The Act defines a bot as an automated online account where all or substantially all of the actions or posts of that account are not directly generated by a live natural person, and prohibits using a bot to communicate or interact with a person in New Jersey, in connection with the sale or advertisement of merchandise or real estate, or to solicit election support, unless the person discloses at the outset of the communication or interaction, in clear and conspicuous fashion, that the communication or interaction is being conducted by or through a bot.

The Act does not impose a duty on a service provider of an online platform, including an Internet web hosting service provider or an Internet service provider, so the disclosure duty falls on the bot's operator, not the host. Civil penalties run $2,500 for a first offense, $5,000 for a second, and $10,000 for each subsequent offense, enforced by the Superior Court, with injunctive relief also available to the Attorney General.

The operative prohibition covers only using an online bot to communicate or interact with a person in New Jersey in connection with the sale or advertisement of merchandise or real estate or to solicit election support.

Personal data excludes de-identified data and publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes a consumer lawfully made available to the public and did not restrict to a specific audience.

The Act applies to a controller conducting business in New Jersey or targeting New Jersey residents that controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers where the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; this second limb carries no percentage threshold on how much revenue must come from data sales.

Biometric data is defined to include, but not be limited to, fingerprint, voiceprint, eye retinas, irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics used or intended to be used to identify a specific individual, and the definition excludes a digital or physical photograph, an audio or video recording, and data generated from one unless the data is generated to identify a specific individual.

Approved January 16, 2024, the Act takes effect on the 365th day following enactment, January 15, 2025. Enforcement belongs to the Office of the Attorney General, which has sole and exclusive authority, and the Act provides no basis for a private right of action.

The Board of Public Utilities directed electric, natural gas, and water and wastewater utilities to implement the order's Cyber Security Program requirements at a minimum. The order's covered assets are industrial control systems and customer information systems that contain personal information. A utility must have a Cyber Security Program that defines and implements organizational oversight, accountabilities, and responsibilities for cyber risk management activities.

The program must annually inventory critical systems and assess and prioritize cyber risks to them. A utility must monitor log files of critical systems. A utility must establish a Cyber Security Incident Response Plan and conduct an exercise to test it once every 24 calendar months at a minimum. A utility must develop and implement a cyber security awareness program. Utilities must comply with all other requirements no later than October 1, 2017.

Utilities must certify compliance with the minimum requirements on an annual basis. Certification of compliance with the North American Electric Reliability Corporation Critical Infrastructure Protection standards is sufficient for the annual certification for critical systems subject to those standards. The order states that its measures supersede the Board's 2011 Cyber Security related order. The order is effective on March 28, 2016.

A water purveyor is any person that owns a public community water system with more than 500 service connections. Each water purveyor must develop a cybersecurity program in accordance with requirements established by the New Jersey Cybersecurity and Communications Integration Cell.

As part of the program a water purveyor must identify the individual chiefly responsible, conduct risk assessments and implement appropriate controls, maintain situational awareness of cyber threats and vulnerabilities, and create and exercise incident response and recovery plans. A water purveyor must submit a copy of its cybersecurity program to the New Jersey Cybersecurity and Communications Integration Cell.

Each water purveyor must join the New Jersey Cybersecurity and Communications Integration Cell and create a cybersecurity incident reporting process. Each water purveyor must obtain a cybersecurity insurance policy that meets any applicable standards adopted by the Board of Public Utilities.

A water purveyor must update its cybersecurity program to apply to all of the water system's industrial control systems and to reasonably conform to the most recent version of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the CIS Critical Security Controls, or the ISO and IEC 27000 family of standards. Each year each water purveyor must submit a certification to the Board of Public Utilities, the Department of Environmental Protection and the Cell.

A water purveyor must, on request of the Board, the Department or the Cell, provide proof of compliance. The Cell must cause an audit of any public community water system that fails to submit a cybersecurity program. A violation is subject to the penalties and other remedies in section 10 of chapter 224 of the Laws of 1977. The Water Quality Accountability Act was approved on July 21, 2017. Chapter 262 of the Laws of 2021 amended section 4 of the Act. Chapter 262 was approved on November 8, 2021 and took effect immediately.

A business or public entity must destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information, once the records are no longer retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable, undecipherable, or non-reconstructable through generally available means.

A willful, knowing, or reckless violation is deemed an unlawful practice and a violation of the Consumer Fraud Act, enforceable by the Attorney General for a civil penalty and injunctive relief, and actionable by a consumer for an ascertainable loss under the Consumer Fraud Act's private right of action, trebled with reasonable attorney's fees.

Utilities must report cyber events relating to industrial control systems to the Board's Reliability and Security Division staff. The reportable events include a person accessing the control system without authorization or exceeding authorized access. The reportable events include unauthorized programs, information, code or commands discovered on a control system.

The reportable events include a person extorting money or another thing of value by threatening to cause damage to the control system. Reports must be made within 6 hours of the detection of an incident. Reports must be submitted through the New Jersey Cybersecurity and Communications Integration Cell. Utilities must also report unusual cyber activity that has the potential to compromise critical systems and for which controls are ineffective.

Utilities must copy the Division staff on notifications to State law enforcement about information breaches involving customers' personally identifiable information, to the extent State law requires those notifications. Utilities must join the Cell and create a cyber security incident reporting process no later than 60 days after the effective date of the order.

Every public agency and government contractor must report cybersecurity incidents to the New Jersey Office of Homeland Security and Preparedness. The report is due within 72 hours of when the public agency or government contractor reasonably believes that a cybersecurity incident has occurred.

A government contractor is an individual or entity that performs work for or on behalf of a public agency on a contract basis with access to or hosting of the public agency's network, systems, applications, or information. A cybersecurity incident is a malicious or suspicious event occurring on or conducted through a computer network that jeopardizes the integrity, confidentiality, or availability of an information system or the information the system processes, stores, or transmits.

The reporting system must accept a cybersecurity incident notification from any individual or private entity, whether or not the entity is a public agency or government contractor. A cybersecurity incident notification submitted under the act is deemed confidential and non-public and is not subject to the Open Public Records Act. The act took effect immediately and was approved on March 13, 2023.

A water purveyor must report to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of a cybersecurity incident. The duty begins 90 days after the effective date of chapter 262 of the Laws of 2021.

The duty covers any cybersecurity incident that compromises the confidentiality, integrity, availability, or privacy of the water purveyor's utility billing, communications, data management, or business information systems, or the information on them. The duty also covers any cybersecurity incident against the industrial control system that adversely impacts, disables, or manipulates infrastructure, resulting in loss of service, contamination of finished water, or damage to infrastructure.

No later than 30 days after receiving a report, the Cell must cause the water purveyor's cybersecurity program and its response to the incident to be audited. The audit is conducted by a qualified and independent cybersecurity company at the water purveyor's expense. Following the audit, the water purveyor must submit the audit and any corrective action plans to the Cell. Chapter 262 was approved on November 8, 2021 and took effect immediately.

The Act may be cited as the New Jersey Age-Appropriate Design Code. It binds a covered online service provider, which is an entity that conducts business in New Jersey, offers online services reasonably likely to be accessed by a child or minor, and has annual gross revenue above $25,000,000 or annually processes the personal data of at least 25,000 consumers or households.

An online service is a service or product that is accessible to the public through the Internet, displays content generated by account holders, and lets account holders interact with content associated with other account holders as a central feature. A covered online service provider does not include an entity that solely provides a direct messaging service or product. The Act does not apply to a federal, State, tribal or local government entity in the ordinary course of operations.

A covered online service provider must configure all default privacy settings for a covered child and covered minor to the highest level of privacy. It must prohibit the display of a covered child's or covered minor's location to other users unless the child or minor has chosen to share it with a specific user. It must establish a prominent and accessible user interface for a covered child, covered minor and parent to report harms experienced on the online service.

It must not send notifications to a covered child or covered minor by default. It must not send notifications to a covered child or covered minor between 10:00 p.m. and 6:00 a.m. or, on a weekday between Labor Day and Memorial Day, between 8:00 a.m. and 4:00 p.m. It must not target, or allow an advertiser to target, an advertisement to a covered child or covered minor for narcotic drugs, tobacco products, gambling or alcohol.

It must not use dark patterns in regard to a covered child or covered minor. It must not use the personal data of a covered child or covered minor for any reason other than the reason for which the data was collected. It must not use that personal data to select, recommend or prioritize media with an algorithmic recommendation system except on the grounds the Act lists.

It must process or retain only the minimum amount of that personal data that is necessary to provide the specific features of the online service with which the child or minor has knowingly engaged. A provider that collects personal data to verify a user's age must not use it for any other purpose and must delete it not later than 15 days after verifying the age.

It must provide a prominent and accessible mechanism for a covered child or covered minor to request that the account be unpublished or permanently deleted. It must take all reasonable steps to ensure that its use of a covered child's or covered minor's personal data and the design of a covered design feature do not result in compulsive use.

It must give a covered child or covered minor a prominent and constant real-time signal when precise geolocation information is being collected or used, or when the child's or minor's online activity is being monitored by any individual, including a parent. A violation of the Act or of rules adopted under it is an unlawful practice and a violation of P.L.1960, c.39 (C.56:8-1 et seq.), the New Jersey Consumer Fraud Act.

The Attorney General has the same authority to conduct civil investigations, bring civil actions and enter into assurances of discontinuance as under that Act. A covered child or covered minor injured by a violation may bring a civil action against the covered online service provider, as may the Attorney General or a parent on the child's or minor's behalf.

For a negligent or greater violation, a court may award $5,000 per violation or treble damages, whichever is greater, together with punitive damages for reckless or knowing violations, injunctive and declaratory relief, and attorney's fees and litigation costs. Governor Sherrill signed the Act on August 11, 2026. The Act takes effect on the first day of the 13th month following the date of enactment, which for an enactment on August 11, 2026 is September 1, 2027.

Requires a controller that has actual knowledge, or willfully disregards, that a consumer is at least 13 but younger than 17 years of age to obtain the consumer's own opt in consent before processing personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects, and treats personal data collected from a known child under 13 as sensitive data that must be processed in accordance with COPPA.