What Is the New Jersey Data Protection Act?
NJDPA applies to controllers who conduct business in NJ and process personal data of 100,000+ NJ consumers (or 25,000+ while selling data). It grants rights to delete, correct, access, port, and opt out of sale, targeted advertising, and profiling. Enforcement is exclusive to the Division of Consumer Affairs, with civil penalties up to $10,000 per first offense and $20,000 per subsequent violation. A 30-day cure period was originally included but sunsets in mid-2026. NJ also operates the original Daniel's Law, which provides expedited removal for judges, prosecutors, and law enforcement.
At a glance
- Full name
- New Jersey Data Protection Act
- Short code
- NJDPA
- Effective date
- January 15, 2025
- Response deadline
- 45 days
- Cure period
- 30 days
- Private right of action
- No
- Enforcement
- New Jersey Division of Consumer Affairs + Attorney General
- Maximum penalty
- Up to $10,000 for the first violation; up to $20,000 for each subsequent violation under the NJ Consumer Fraud Act
- Statutory citation
- N.J. Stat. Ann. § 56:8-166.4 et seq.
Who NJDPA applies to
A business is covered if it meets the applicability thresholds set out in N.J. Stat. Ann. § 56:8-166.4 et seq.. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Conducts business in New Jersey or targets New Jersey residents, AND
- Controls or processes personal data of 100,000+ New Jersey consumers in a calendar year, OR
- Controls or processes personal data of 25,000+ New Jersey consumers AND derives any revenue or receives any discount from the sale of personal data
Consumer rights under NJDPA
NJDPA: delete, access, correct, port, opt-out
Daniel's Law: 10-business-day removal for covered persons
Division of Consumer Affairs enforcement
Penalties up to $20,000 per subsequent violation
Notable features (vs. CCPA)
NJDPA has the strongest minor protection among post-CCPA state laws: it requires opt-in consent before processing the personal data of known minors under 17 for targeted advertising, sale, or profiling. The Division of Consumer Affairs will issue rules starting in 2025, expanding statutory requirements. The law also recognizes a Universal Opt-Out Mechanism (like Global Privacy Control) beginning July 15, 2025.
Enforcement & penalties
Enforcing agency: New Jersey Division of Consumer Affairs + Attorney General
Maximum penalty: Up to $10,000 for the first violation; up to $20,000 for each subsequent violation under the NJ Consumer Fraud Act
Cure period: NJDPA carries a 30-day cure period that sunsets 18 months after the effective date (July 15, 2026).
Private right of action: NJDPA has no private right of action. Enforcement runs through the New Jersey Division of Consumer Affairs and the Attorney General.
Where to file a complaint: New Jersey Division of Consumer Affairs
How to exercise your NJDPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies NJDPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a New Jersey resident (e.g., ZIP code, email associated with your record).
- 3
Under NJDPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the New Jersey Division of Consumer Affairs at https://www.njconsumeraffairs.gov/File-a-Complaint.
Use your rights
NJDPA-compliant deletion emails, $5 one-time
OfflistMe drafts NJDPA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
Does NJDPA overlap with Daniel's Law?+
They complement each other. Daniel's Law is a faster, narrower removal mechanism for judges, prosecutors, and law enforcement officers (10 business days). NJDPA is broader — it applies to all New Jersey residents — with a 45-day deadline. Covered persons can use whichever applies.
How do I use Daniel's Law if I qualify?+
Qualifying persons (judges, prosecutors, law enforcement, and immediate family) submit a removal request citing P.L. 2020, c. 125. Brokers must remove the address within 10 business days. Non-compliance can be enforced in court with statutory damages.
Official sources & citations
Compare with sibling state laws
NJDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: