What Is the New Jersey Data Privacy Act (NJDPA)?
NJDPA applies to controllers that conduct business in New Jersey or target New Jersey residents and meet its 100,000-consumer or 25,000-consumer-plus-sale-revenue/discount threshold, subject to scope and exemptions. It grants rights to delete, correct, access, port, and opt out of sale, targeted advertising, and profiling. Controllers generally have 45 days to respond, with a possible 45-day extension when permitted. Covered controllers must allow a user-selected universal opt-out mechanism for targeted advertising or sale; the Attorney General has sole and exclusive enforcement authority, and the original 30-day cure period sunset July 1, 2026. A separate P.L. 2026, c. 25 adds registration, fee, and sensitive-data-sale requirements for covered New Jersey data brokers and data collectors; those supplemental rules are not part of the NJDPA thresholds summarized here. Daniel's Law remains a separate route for covered people and information.
At a glance
- Full name
- New Jersey Data Privacy Act
- Short code
- NJDPA
- Effective date
- January 15, 2025
- Response reference
- 45 days in this snapshot
- Cure period
- None recorded in this snapshot
- Private right of action
- No
- Enforcement
- New Jersey Attorney General. Division of Consumer Affairs
- Penalty reference
- Up to $10,000 for the first violation; up to $20,000 for each subsequent violation under the NJ Consumer Fraud Act
- Statutory citation
- N.J. Stat. Ann. §§ 56:8-166.4–56:8-166.19
Who NJDPA applies to
A business is covered if it meets the applicability thresholds set out in N.J. Stat. Ann. §§ 56:8-166.4–56:8-166.19. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in New Jersey or targets New Jersey residents and, during a calendar year, controls or processes the personal data of at least 100,000 consumers, excluding data processed solely for payment transactions
- Conducts business in New Jersey or targets New Jersey residents and, during a calendar year, controls or processes the personal data of at least 25,000 consumers and derives revenue or receives a discount on goods or services from the sale of personal data
Continue with related privacy resources
Follow the route that matches your next question. Each link stays within a documented topic cluster and points to a canonical content page.
Consumer rights under NJDPA
NJDPA: delete, access, correct, port, opt-out
Separate 2026 data-broker registration and sensitive-data-sale rules apply to covered data brokers and data collectors
Daniel's Law: after a qualifying written notice, covered private-internet disclosures generally must stop within 10 business days (P.L. 2021, c. 371 repealed the original 72-hour provision); the OIP government-site route is separate
Attorney General enforcement with Division of Consumer Affairs implementation
Penalties up to $20,000 per subsequent violation
Notable features (vs. CCPA)
NJDPA requires consent before processing the personal data of a consumer the controller knows, or willfully disregards, is at least 13 but younger than 17 for targeted advertising, sale, or profiling. Covered controllers must allow a user-selected universal opt-out mechanism for targeted advertising or sale no later than July 15, 2025; the Division of Consumer Affairs may issue implementation rules. Separate P.L. 2026, c. 25 adds New Jersey data-broker and data-collector registration, fee, and sensitive-data-sale provisions; those supplemental requirements are not part of the NJDPA applicability thresholds summarized here.
Enforcement and penalty reference
Enforcing agency: New Jersey Attorney General. Division of Consumer Affairs
Penalty reference: Up to $10,000 for the first violation; up to $20,000 for each subsequent violation under the NJ Consumer Fraud Act
Cure period: The NJDPA's separate 30-day enforcement notice-and-cure opportunity ended July 1, 2026, under N.J.S.A. 56:8-166.17(b)'s 18th-month sunset. As of this review, the statute does not provide a general automatic cure right; the Division/AG's current enforcement procedure and the facts of a matter still govern.
Private right of action: NJDPA has no private right of action. The New Jersey Office of the Attorney General has sole and exclusive enforcement authority, with the Division of Consumer Affairs administering implementation provisions.
Where to file a complaint: New Jersey Attorney General. Division of Consumer Affairs
How to exercise your NJDPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global data brokers in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a verifiable consumer request. Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable New Jersey residency, scope, exemption, and verification rules before sending.
- 3
Track the applicable response window. This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
Escalate if denied or ignored. If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the New Jersey Attorney General. Division of Consumer Affairs complaint route at https://www.njconsumeraffairs.gov/Pages/Consumer-Complaints.aspx. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate your NJDPA privacy request, $9 one-time
FAQ
What is New Jersey's data privacy law?+
New Jersey's comprehensive data privacy law is the New Jersey Data Privacy Act (NJDPA), effective January 15, 2025. It gives qualifying consumers rights to access, correct, delete, and port personal data and to opt out of sale, targeted advertising, and certain profiling, subject to the law's thresholds, exemptions, and verification rules. A covered controller generally has 45 days to respond and may extend that period by 45 days when the statute permits; review the enacted law for the current details.
Does NJDPA overlap with Daniel's Law?+
They are separate mechanisms. Daniel's Law is narrower and applies to covered individuals, covered information, and qualifying requests under New Jersey law; its private-internet provisions generally use a 10-business-day notice/non-posting rule, while the Office of Information Privacy handles a separate government-site redaction route. The federal Daniel Anderl Act has a separate 72-hour rule for qualifying federal requests and should not be conflated with New Jersey's state rule. The NJDPA is a broader controller privacy law with its own scope, exemptions, and response framework. Which route applies depends on the person, information, recipient, and request.
How do I use Daniel's Law if I qualify?+
Review the current New Jersey procedure and submit a compliant written notice under P.L. 2021, c. 371, as amended, when that route applies. The New Jersey private-internet rules generally use a 10-business-day notice/non-posting framework; the federal Daniel Anderl Act has a separate 72-hour rule for qualifying federal requests. The OIP portal and government-site redaction process are separate. Keep the request, proof of delivery, and the provider response; available enforcement options depend on the facts and the statute.
Official sources & citations
Compare with sibling state laws
NJDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation:
State privacy-law comparison: effective dates, cure periods, and penalties
18 explainer states are compared from the state-law datasets. The chart emphasizes cure-period days; the table preserves effective dates and penalty wording.
- Highlighted state
- Other states with an explainer
Effective: 2024-07-01
Penalty: Up to $7,500 per violation
Effective: 2023-01-01
Penalty: Up to $7,500 per violation
Effective: 2023-07-01
Penalty: Up to $20,000 per violation under the Colorado Consumer Protection Act
Effective: 2023-07-01
Penalty: Up to $5,000 per violation under the Connecticut Unfair Trade Practices Act
Effective: 2023-12-31
Penalty: Up to $7,500 per violation
Effective: 2024-07-01
Penalty: Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
Effective: 2025-07-01
Penalty: Up to $7,500 per violation; a court may award treble damages for willful or knowing violations
Effective: 2025-01-01
Penalty: Up to $10,000 per violation under the Delaware Consumer Fraud Act
Effective: 2025-01-01
Penalty: Up to $10,000 per violation under RSA 358-A:4
Effective: 2025-01-15
Penalty: Up to $10,000 for the first violation; up to $20,000 for each subsequent violation under the NJ Consumer Fraud Act
Effective: 2025-10-01
Penalty: Up to $10,000 per violation; up to $25,000 for repeat violations under the Maryland Consumer Protection Act
Effective: 2025-07-31
Penalty: Up to $7,500 per violation under existing consumer protection authority
Effective: 2025-01-01
Penalty: Up to $7,500 per violation under the Iowa Consumer Fraud Act
Effective: 2024-10-01
Penalty: Up to $7,500 for each violation under Mont. Code Ann. § 30-14-2820, following the statutory notice-and-cure period
Effective: 2026-01-01
Penalty: Up to $7,500 for each violation under Ind. Code § 24-15-10-2, plus reasonable enforcement expenses
Effective: 2025-01-01
Penalty: Up to $7,500 in civil penalties for each violation under Neb. Rev. Stat. § 87-1124, following the statutory cure period or a breach of the written statement
Effective: 2026-01-01
Penalty: Up to $7,500 in damages for each continued violation under Ky. Rev. Stat. § 367.3627
Effective: 2026-01-01
Penalty: An intentional disclosure to a shell entity or in violation of the chapter carries a $100–$500 fine per disclosure under R.I. Gen. Laws § 6-48.1-8; other Deceptive Trade Practices Act remedies are not summarized here
“None” follows the explainer's null cure-period field; it is not an inference about a different provision. Effective dates are “Not stated” when the matching state-page field is absent.
Show the data as a table
| State | Effective date | Cure period | Penalty text |
|---|---|---|---|
| Texas | 2024-07-01 | 30 days | Up to $7,500 per violation |
| Virginia | 2023-01-01 | 30 days | Up to $7,500 per violation |
| Colorado | 2023-07-01 | none | Up to $20,000 per violation under the Colorado Consumer Protection Act |
| Connecticut | 2023-07-01 | none | Up to $5,000 per violation under the Connecticut Unfair Trade Practices Act |
| Utah | 2023-12-31 | 30 days | Up to $7,500 per violation |
| Oregon | 2024-07-01 | none | Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act |
| Tennessee | 2025-07-01 | 60 days | Up to $7,500 per violation; a court may award treble damages for willful or knowing violations |
| Delaware | 2025-01-01 | none | Up to $10,000 per violation under the Delaware Consumer Fraud Act |
| New Hampshire | 2025-01-01 | none | Up to $10,000 per violation under RSA 358-A:4 |
| New Jersey | 2025-01-15 | none | Up to $10,000 for the first violation; up to $20,000 for each subsequent violation under the NJ Consumer Fraud Act |
| Maryland | 2025-10-01 | none | Up to $10,000 per violation; up to $25,000 for repeat violations under the Maryland Consumer Protection Act |
| Minnesota | 2025-07-31 | none | Up to $7,500 per violation under existing consumer protection authority |
| Iowa | 2025-01-01 | 90 days | Up to $7,500 per violation under the Iowa Consumer Fraud Act |
| Montana | 2024-10-01 | 30 days | Up to $7,500 for each violation under Mont. Code Ann. § 30-14-2820, following the statutory notice-and-cure period |
| Indiana | 2026-01-01 | 30 days | Up to $7,500 for each violation under Ind. Code § 24-15-10-2, plus reasonable enforcement expenses |
| Nebraska | 2025-01-01 | 30 days | Up to $7,500 in civil penalties for each violation under Neb. Rev. Stat. § 87-1124, following the statutory cure period or a breach of the written statement |
| Kentucky | 2026-01-01 | 30 days | Up to $7,500 in damages for each continued violation under Ky. Rev. Stat. § 367.3627 |
| Rhode Island | 2026-01-01 | none | An intentional disclosure to a shell entity or in violation of the chapter carries a $100–$500 fine per disclosure under R.I. Gen. Laws § 6-48.1-8; other Deceptive Trade Practices Act remedies are not summarized here |
Sources (36)
Texas Business & Commerce Code, Chapter 541 (TDPSA) · Texas AG. Consumer Privacy · Virginia Code § 59.1-575 (VCDPA) · Virginia AG. Consumer Privacy · Colorado Revised Statutes 2026, Title 6, Part 13 (Colorado Privacy Act) · Colorado AG. Data Privacy · Connecticut Attorney General. The Connecticut Data Privacy Act · Connecticut Public Act 25-113 · Utah Code Title 13, Chapter 61 (UCPA) · Utah Code § 13-61-201, effective July 1, 2026 · Oregon Revised Statutes Chapter 646A (2025 edition; check later session laws) · Oregon Legislature. Current ORS update and session-law notice · Tennessee Code, Title 47, Chapter 18, Part 33 (official code volume) · Tennessee Attorney General. TIPA consumer and business guide · Delaware Code Title 6, Chapter 12D (DPDPA) · Delaware DOJ. Consumer Protection · New Hampshire Revised Statutes, Chapter 507-H (NHDPA) · New Hampshire Revised Statutes § 358-A:4 · NJDPA (P.L. 2023, c. 266. Full Text) · New Jersey Division of Consumer Affairs · Maryland SB 541 / MODPA (Signed Chapter 455) · Maryland AG. Consumer Protection Division · Minnesota Statutes Chapter 325M (MCDPA) · Minnesota AG. Consumer Protection · Iowa Code Chapter 715D (ICDPA) · Iowa AG. Consumer Protection · Montana Code Title 30, Chapter 14, Part 28 (MTCDPA) · Montana DOJ. Montana Consumer Data Privacy / SB 297 · Indiana Code Title 24, Article 15 (INCDPA) · Indiana Attorney General. Consumer Data Bill of Rights · Nebraska Revised Statutes §§ 87-1101–87-1130 (NBDPA) · Nebraska Revised Statute § 87-1103 (applicability) · Kentucky Revised Statutes Chapter 367 (KCDPA sections) · Kentucky Revised Statutes § 367.3611 (July 1, 2027 version) · Rhode Island General Laws Title 6, Chapter 48.1 (RIDTPPA) · Rhode Island General Laws § 6-48.1-3 (information sharing practices)
Checked state pages 2026-10-14; law explainers 2026-10-11
Recorded state response-window references
The bars show deletionDeadlineDays values recorded in the state-page dataset; states without that field remain visible in a separate list.
- Highlighted focus state
- Other recorded states
This is a reference window recorded in this dataset; confirm the statute, request type, controller scope, verification rules, extensions, and exceptions before treating it as a deadline. A recorded window does not predict acceptance or completion.
Not recorded: Alabama, Alaska, Arizona, Arkansas, Georgia, Hawaii, Idaho, Illinois, Kansas, Louisiana, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Vermont, Washington, West Virginia, Wisconsin, Wyoming.
Show the data as a table
| State | Reference window | Dataset status |
|---|---|---|
| Alabama | Not recorded | Context |
| Alaska | Not recorded | Context |
| Arizona | Not recorded | Context |
| Arkansas | Not recorded | Context |
| California | 45 days | Context |
| Colorado | 45 days | Context |
| Connecticut | 45 days | Context |
| Delaware | 45 days | Context |
| Florida | 45 days | Context |
| Georgia | Not recorded | Context |
| Hawaii | Not recorded | Context |
| Idaho | Not recorded | Context |
| Illinois | Not recorded | Context |
| Indiana | 45 days | Context |
| Iowa | 90 days | Context |
| Kansas | Not recorded | Context |
| Kentucky | 45 days | Context |
| Louisiana | Not recorded | Context |
| Maine | Not recorded | Context |
| Maryland | 45 days | Context |
| Massachusetts | Not recorded | Context |
| Michigan | Not recorded | Context |
| Minnesota | 45 days | Context |
| Mississippi | Not recorded | Context |
| Missouri | Not recorded | Context |
| Montana | 45 days | Context |
| Nebraska | 45 days | Context |
| Nevada | Not recorded | Context |
| New Hampshire | 45 days | Context |
| New Jersey | 45 days | Focus state |
| New Mexico | Not recorded | Context |
| New York | Not recorded | Context |
| North Carolina | Not recorded | Context |
| North Dakota | Not recorded | Context |
| Ohio | Not recorded | Context |
| Oklahoma | Not recorded | Context |
| Oregon | 45 days | Context |
| Pennsylvania | Not recorded | Context |
| Rhode Island | 45 days | Context |
| South Carolina | Not recorded | Context |
| South Dakota | Not recorded | Context |
| Tennessee | 45 days | Context |
| Texas | 45 days | Context |
| Utah | 45 days | Context |
| Vermont | Not recorded | Context |
| Virginia | 45 days | Context |
| Washington | Not recorded | Context |
| West Virginia | Not recorded | Context |
| Wisconsin | Not recorded | Context |
| Wyoming | Not recorded | Context |
Sources (50)
California attorney-general source · Texas attorney-general source · Florida attorney-general source · New York attorney-general source · Virginia attorney-general source · Colorado attorney-general source · Illinois attorney-general source · Washington attorney-general source · Connecticut attorney-general source · Oregon attorney-general source · Utah attorney-general source · Pennsylvania attorney-general source · Ohio attorney-general source · Georgia attorney-general source · Massachusetts attorney-general source · New Jersey attorney-general source · Minnesota attorney-general source · Tennessee attorney-general source · Maryland attorney-general source · Delaware attorney-general source · New Hampshire attorney-general source · Indiana attorney-general source · Iowa attorney-general source · Montana attorney-general source · Nebraska attorney-general source · Kentucky attorney-general source · Rhode Island attorney-general source · Arizona attorney-general source · North Carolina attorney-general source · Michigan attorney-general source · Nevada attorney-general source · Vermont attorney-general source · Wisconsin attorney-general source · Missouri attorney-general source · Alabama attorney-general source · South Carolina attorney-general source · Louisiana attorney-general source · Oklahoma attorney-general source · Kansas attorney-general source · Mississippi attorney-general source · Arkansas attorney-general source · West Virginia attorney-general source · Maine attorney-general source · New Mexico attorney-general source · Idaho attorney-general source · Hawaii attorney-general source · Alaska attorney-general source · North Dakota attorney-general source · South Dakota attorney-general source · Wyoming attorney-general source
Checked state pages 2026-10-14