P.L.2023, c.266 (S332): New Jersey consumer data privacy law, including the right to opt out of profiling and data protection assessments

Summary

New Jersey's comprehensive consumer data privacy law gives consumers a right to opt out of the processing of their personal data for targeted advertising, for sale, and for profiling in furtherance of decisions that produce legal or similarly significant effects. Profiling is defined as automated processing used to evaluate, analyze or predict an individual's economic situation, health, preferences, reliability, behavior, location or movements. Controllers must conduct and document a data protection assessment before processing that presents a heightened risk of harm, which includes profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial or physical injury, and must make assessments available to the Division of Consumer Affairs on request. The law applies to controllers that process the personal data of at least 100,000 New Jersey consumers a year (excluding data processed only to complete a payment), or 25,000 consumers where they earn revenue from selling personal data. Financial institutions and their affiliates subject to Title V of the Gramm-Leach-Bliley Act are outside the law. Violations are unlawful practices under the Consumer Fraud Act, enforced only by the Attorney General; there is no private right of action. The Division of Consumer Affairs proposed implementing rules in June 2025; a law-firm report states that proposal expired unadopted on June 2, 2026.

Key dates

1. January 16, 2024Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. This act shall take effect on the 365th day following the date of enactment, except that the Director of the Division of Consumer Affairs may take any anticipatory administrative action in advance

   Supports: Effective date rule

   Approved January 16, 2024.

   Supports: Approval date

   opt out of the processing of personal data for the purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Right to opt out of profiling

   “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

   Supports: Definition of profiling

   processing personal data for purposes of targeted advertising or for profiling if the profiling presents a reasonably foreseeable risk of: unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial or physical injury to consumers

   Supports: Profiling as heightened-risk processing requiring a data protection assessment

   control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction

   Supports: Applicability threshold

   a financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal “Gramm-Leach-Bliley Act,”

   Supports: GLBA exclusion

   The Office of the Attorney General shall have sole and exclusive authority to enforce a violation of P.L.2023, c.266 (C.56:8-166.4 et seq.).

   Supports: Enforcement

   P.L. 2023, c.266 (S332 6R) New Jersey Legislature (Office of Legislative Services) Primary source

2. Regulations proposed in June 2025 to implement the New Jersey Data Privacy Law expired on June 2, 2026, when the regulations were not adopted within a year of the proposal.

   Supports: Status of implementing rules

   New Jersey's Proposed Data Privacy Regulations Have Expired Troutman Pepper Locke (Privacy + Cyber + AI blog) Reporting or analysis