New Jersey Data Removal Guide (2026)
New Jersey is the birthplace of Daniel's Law and, as of January 2025, home to a comprehensive consumer privacy statute. The NJDPA grants rights to qualifying consumers against covered controllers, while Daniel's Law is a separate route for covered people and information.
Research status: this is a dated state-law snapshot; verify the current official sources before relying on a right, deadline, penalty, or complaint route.
This page is educational orientation, not legal advice. Scope, exemptions, deadlines, penalties, regulator powers and broker routes can change. Verify the current statute and state regulator guidance before relying on a right or deadline.
At a glance
- Comprehensive state privacy law
- Recorded: NJDPA
- Broker response deadline
- 45 days in this research snapshot for qualifying requests; extensions and exemptions may apply
- Enforcement
- New Jersey Attorney General. Division of Consumer Affairs
New Jersey Data Privacy Act (NJDPA)
NJDPA applies to controllers that conduct business in New Jersey or target New Jersey residents and meet its 100,000-consumer or 25,000-consumer-plus-sale-revenue/discount threshold, subject to scope and exemptions. It grants rights to delete, correct, access, port, and opt out of sale, targeted advertising, and profiling. Controllers generally have 45 days to respond, with a possible 45-day extension when permitted. Covered controllers must allow a user-selected universal opt-out mechanism for targeted advertising or sale; the Attorney General has sole and exclusive enforcement authority, and the original 30-day cure period sunset July 1, 2026. A separate P.L. 2026, c. 25 adds registration, fee, and sensitive-data-sale requirements for covered New Jersey data brokers and data collectors; those supplemental rules are not part of the NJDPA thresholds summarized here. Daniel's Law remains a separate route for covered people and information.
Read the full NJDPAexplainer →Scope, thresholds, exceptions, cure rules, and enforcement details where documented.
What rights do New Jersey residents have?
- →NJDPA: delete, access, correct, port, opt-out
- →Separate 2026 data-broker registration and sensitive-data-sale rules apply to covered data brokers and data collectors
- →Daniel's Law: qualifying private-internet requests can trigger a 72-hour removal rule, with a distinct 10-business-day notice/non-posting rule under applicable provisions; the OIP government-site route is separate
- →Attorney General enforcement with Division of Consumer Affairs implementation
- →Penalties up to $20,000 per subsequent violation
Where does your data leak from in New Jersey?
The FTC explains that people-search sites may combine public records, public social profiles, and information from other brokers. The examples below are a research snapshot, not an exhaustive or person-specific source map for New Jersey:
- NJ Courts public access system
- Essex, Bergen, Middlesex County property records
- New Jersey MVC driver records
- NJ Department of State business filings
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
What if a broker ignores your request?
If a qualifying request does not receive a response within the applicable window, review the current extension and exemption rules, then consider the New Jersey Attorney General. Division of Consumer Affairs complaint route. The authority's jurisdiction and available remedies vary.
File a complaint with New Jersey Attorney General. Division of Consumer Affairs ↗FAQ: New Jersey data removal
What is New Jersey's data privacy law?+
New Jersey's comprehensive data privacy law is the New Jersey Data Privacy Act (NJDPA), effective January 15, 2025. It gives qualifying consumers rights to access, correct, delete, and port personal data and to opt out of sale, targeted advertising, and certain profiling, subject to the law's thresholds, exemptions, and verification rules. A covered controller generally has 45 days to respond and may extend that period by 45 days when the statute permits; review the enacted law for the current details.
Does NJDPA overlap with Daniel's Law?+
They are separate mechanisms. Daniel's Law is narrower and applies to covered individuals, covered information, and qualifying requests under New Jersey law; its private-internet provisions generally use a 10-business-day notice/non-posting rule, while the Office of Information Privacy handles a separate government-site redaction route. The federal Daniel Anderl Act has a separate 72-hour rule for qualifying federal requests and should not be conflated with New Jersey's state rule. The NJDPA is a broader controller privacy law with its own scope, exemptions, and response framework. Which route applies depends on the person, information, recipient, and request.
How do I use Daniel's Law if I qualify?+
Review the current New Jersey procedure and submit a compliant written notice under P.L. 2021, c. 371, as amended, when that route applies. The New Jersey private-internet rules generally use a 10-business-day notice/non-posting framework; the federal Daniel Anderl Act has a separate 72-hour rule for qualifying federal requests. The OIP portal and government-site redaction process are separate. Keep the request, proof of delivery, and the provider response; available enforcement options depend on the facts and the statute.