Who it applies to
Businesses that control or process personal data of 100,000 or more New Jersey residents, or 25,000 or more residents if the business derives revenue from selling personal data.
What it requires
- Consumer rights to access, correct, delete, and opt out of sale, targeted advertising, and profiling
- Data protection assessments for high-risk processing
- Recognition of universal opt-out signals
What's changed recently
New Jersey's mandatory 30-day cure period for first-time violations ended July 15, 2026. Before that date, a business got a warning and a chance to fix an issue before being fined. Now, enforcement starts with a penalty, not a warning.
Informational summary, not legal advice. Reviewed for accuracy as of August 2026; laws and enforcement priorities change, so verify current requirements against the official regulator text before relying on this page.