New Jersey NJDPA
New Jersey Data Privacy Act (P.L.2023, c.266; N.J.S.A. 56:8-166.4 et seq.)
The NJDPA is New Jersey's consumer privacy law, effective 15 January 2025. It covers controllers that meet consumer-count thresholds, treats biometric and financial account data as sensitive, and directs the Division of Consumer Affairs to adopt implementing rules.
Who it applies to
Controllers doing business in New Jersey or targeting its residents that control or process the personal data of 100,000 or more consumers (excluding payment-only data), or 25,000 or more consumers while deriving revenue or receiving a discount from selling personal data.
Identity requirements
- Obtain affirmative consent before processing sensitive data, including biometric and genetic data and financial account credentials
- Obtain consent before targeted advertising, sale or profiling involving consumers the controller knows are 13 to 17
- Conduct data protection assessments before processing that presents a heightened risk of harm
- Honor universal opt-out preference signals and rights to access, correct, delete and port data
- Authenticate consumer rights requests using commercially reasonable methods
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Affirmative consent for sensitive data and minors must be recorded and honored across channels. |
| Identity verification (KYC/proofing) | Rights requests must be authenticated, and biometric proofing is sensitive data. |
| Audit, logging & accountability | Assessments must be completed before high-risk processing begins. |
Penalties
Violations are enforced under the New Jersey Consumer Fraud Act, with civil penalties of up to 10,000 dollars for a first violation and 20,000 dollars for subsequent violations. A 30-day cure period applied for the first 18 months after the effective date.
Status and dates last verified against primary sources on 2026-10-31.
New Jersey NJDPA: frequently asked questions
- When did the New Jersey Data Privacy Act take effect?
- It took effect on 15 January 2025.
- Are the NJDPA rules final?
- The Division of Consumer Affairs proposed implementing rules (N.J.A.C. 13:45L); check the Division's site for whether they have been adopted, as they were still at the proposal stage in mid-2026.