New Jersey Enacted Data Broker Regulation Law
The state now requires companies that sell consumer information to register and pay tiered annual fees.
Updated on Sept. 28, 2026 in Cybersecurity
Live Poll
Should companies that collect and share consumer data be required to join a public registry?
In June 2026, New Jersey enacted a law classifying publishers as data collectors if they share user information with third-party brokers. The legislation mandates that these entities register their activities with the state by April 2027.
Why it matters
The law extends data broker oversight to publishers by removing minimum data collection thresholds, forcing a broader range of companies to disclose their business practices. It also restricts the trade of sensitive health and biometric information.
Registration fees are tiered by consumer volume, starting at $5,000 for entities handling 100,000 or fewer records and scaling to $1.5 million for those managing more than 4.5 million.
The players
New Jersey State Legislature
The state legislative body responsible for drafting, passing, and now revisiting the compliance requirements for the data broker registry.
The details
The law defines data collectors as any company that gathers consumer information and subsequently sells or licenses it to third parties. Publishers now fall under this classification if they transmit user data to qualifying brokers. To comply, companies must submit their name, address, website, privacy policy, and opt-out procedures to a public registry.
Timeline
June 2026: New Jersey enacted the data broker law.
June 30, 2026: A ban on the sale of sensitive health and biometric data took effect.
April 1, 2027: The state data registry opens for mandatory company submissions.
April 2027: The deadline for data collectors to complete their registration.
The Tech Race
New Jersey's mandate follows the pattern set by the California Consumer Privacy Act in formalizing state-level oversight of the data brokerage ecosystem. It marks a departure from purely federal approaches by compelling publishers to disclose their secondary data sharing relationships.
Residents gain increased transparency as publishers must now list their data-selling practices in a public state registry. Companies must also stop selling sensitive biometric or health-related data, effective since June 2026.
The takeaway
This law forces companies to account for previously opaque data-sharing partnerships that occur behind the scenes of digital publishing. Readers should track the legislature's planned revisions in early 2027 to see if enforcement thresholds or fee structures change before the registration deadline.
What happens next
The state is expected to provide technical guidance on the registry process before registration opens on April 1, 2027.
Further reading
For broader context on how regional policy impacts digital privacy, visit Cybersecurity.
Source note: This article includes information reported by AdExchanger.
Live Poll
Should companies that collect and share consumer data be required to join a public registry?
