New Jersey Data Protection Act (NJDPA)

The New Jersey Data Protection Act (NJDPA) was signed into law on January 16, 2024, and takes effect on January 15, 2025. New Jersey became one of the most populous US states to enact comprehensive consumer data privacy legislation.

What Is the NJDPA?

The NJDPA grants New Jersey residents rights over their personal data and imposes obligations on businesses that collect or process that data. The law follows the opt-out model for general personal data and requires opt-in consent for sensitive data processing.

Who Does the NJDPA Apply To?

The NJDPA applies to businesses that conduct business in New Jersey or produce products or services targeted to New Jersey residents, and during the prior calendar year either:

• Controlled or processed the personal data of at least 100,000 consumers (excluding data processed solely for payment transactions); or
• Controlled or processed the personal data of at least 25,000 consumers and derived any revenue from the sale of personal data.

Consumer Rights Under the NJDPA

New Jersey residents are entitled to:

• Right to access: confirm whether a business processes their personal data and request a copy
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to appeal: appeal a business's denial of a rights request

Businesses must respond to verified consumer requests within 45 days, extendable by an additional 45 days when reasonably necessary.

Sensitive Data

Processing sensitive data requires opt-in consent from consumers. Sensitive data under the NJDPA includes racial or ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, sex life, sexual orientation, status as transgender or nonbinary, citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, precise geolocation data, personal data of known children, and financial information (including account numbers, log-in credentials, and credit or debit card numbers combined with access codes). The inclusion of financial information as sensitive data is unique to New Jersey among US state privacy laws.

Opt-Out Signals

The NJDPA requires controllers to recognize universal opt-out signals, such as the Global Privacy Control (GPC), as valid consumer opt-out requests. This means businesses must honor browser-level opt-out signals without requiring additional consumer action.

Enforcement

The New Jersey Attorney General enforces the NJDPA. There is no private right of action. Businesses have a 30-day cure period upon receiving notice of a violation through July 15, 2026 (18 months after the law's effective date); after that date the Attorney General may proceed directly without a mandatory cure step. Violations constitute violations of the New Jersey Consumer Fraud Act, carrying civil penalties of up to $10,000 for a first violation and up to $20,000 for each subsequent violation.

How UniConsent Supports NJDPA Compliance

UniConsent provides the tools businesses need to meet NJDPA requirements:

• Opt-out and opt-in consent banners configurable by state
• Global Privacy Control (GPC) signal recognition
• Consumer rights request management
• Sensitive data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA

• CPRA: California Privacy Rights Act, learn more at CPRA

• CPA: Colorado Privacy Act, learn more at CPA

• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA

• UCPA: Utah Consumer Privacy Act, learn more at UCPA

• CTDPA: Connecticut Data Protection Act, learn more at CTDPA

• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA

• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA

• NHPA: New Hampshire Privacy Act, learn more at NHPA

• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA

• FDBR: Florida Digital Bill of Rights, learn more at FDBR

Compare different US State Privacy Laws