New Jersey NJDPA
New Jersey Data Privacy Act (P.L.2023, c.266; N.J.S.A. 56:8-166.4 et seq.)
The NJDPA is New Jersey's consumer privacy law, effective 15 January 2025. It covers controllers that meet consumer-count thresholds, treats biometric and financial account data as sensitive, and directs the Division of Consumer Affairs to adopt implementing rules.
Who it applies to
Controllers doing business in New Jersey or targeting its residents that control or process the personal data of 100,000 or more consumers (excluding payment-only data), or 25,000 or more consumers while deriving revenue or receiving a discount from selling personal data.
Identity requirements
- Obtain affirmative consent before processing sensitive data, including biometric and genetic data and financial account credentials
- Obtain consent before targeted advertising, sale or profiling involving consumers the controller knows are 13 to 17
- Conduct data protection assessments before processing that presents a heightened risk of harm
- Honor universal opt-out preference signals and rights to access, correct, delete and port data
- Authenticate consumer rights requests using commercially reasonable methods
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Affirmative consent for sensitive data and minors must be recorded and honored across channels. |
| Identity verification (KYC/proofing) | Rights requests must be authenticated, and biometric proofing is sensitive data. |
| Audit, logging & accountability | Assessments must be completed before high-risk processing begins. |
Penalties
The Division of Consumer Affairs states that the Attorney General may go to court to stop violations, seek compensation for victims and require penalties of up to 10,000 dollars for a first offense and 20,000 dollars for later offenses; consumers cannot sue under the law. Until 1 July 2026, the Division gave controllers notice and a chance to fix a potential violation before taking enforcement action.
Status and dates last verified against primary sources on 2026-10-31.
New Jersey NJDPA: frequently asked questions
- When did the New Jersey Data Privacy Act take effect?
- It took effect on 15 January 2025.
- Are the NJDPA rules final?
- The Division of Consumer Affairs proposed implementing rules (N.J.A.C. 13:45L); check the Division's site for whether they have been adopted, as they were still at the proposal stage in mid-2026.