New Jersey Data Privacy Act (NJDPA): your rights, deadlines and the coming data broker registry
Quick answer
New Jersey's Data Privacy Act lets you ask a covered company to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads, including through a universal opt-out signal such as Global Privacy Control. Send your request through the method in the company's privacy notice: it has 45 days to answer, and one request a year is free. A 2026 law adds data broker registration and a public broker list, but the list part only starts 270 days after the law's June 30, 2026 approval, so for now you contact each company yourself.
All privacy laws“(3) delete personal data concerning the consumer;”
- Applies in
- New Jersey
- In force since
- Companies must answer within
- Within 45 days of receiving a verified request. The company can extend by 45 more days when that's reasonably necessary, if it tells you why within the first 45 days. If it refuses, it must say why within 45 days and explain how to appeal. Appeals get a written decision within 45 days. One request per 12 months is free (N.J.S.A. § 56:8-166.7).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: pub.njleg.gov
Last verified against the official page:
New Jersey residents. The law applies to companies that do business in New Jersey or target its residents and that, in a calendar year, handle personal data of at least 100,000 consumers (not counting data used only to complete a payment), or of at least 25,000 consumers while earning revenue or getting a discount from selling personal data (N.J.S.A. § 56:8-166.5). Since June 30, 2026 the ban on selling sensitive data applies to everyone, whatever their size. State agencies and political subdivisions are exempt. So are HIPAA-protected health information, financial institutions and data covered by the Gramm-Leach-Bliley Act, insurance institutions subject to New Jersey's P.L.1985, c.179, and consumer report data as the Fair Credit Reporting Act allows.
Your rights
-
Confirm and access
Ask whether a company processes your personal data and get access to it. Trade secrets are protected (N.J.S.A. § 56:8-166.10a(1)).
-
Correct
Have inaccurate personal data fixed, taking into account what the data is and why the company processes it (N.J.S.A. § 56:8-166.10a(2)).
-
Delete
Have a company delete personal data concerning you (N.J.S.A. § 56:8-166.10a(3)).
-
Get a portable copy
Get your data in a portable, readily usable format (N.J.S.A. § 56:8-166.10a(4)).
-
Opt out
Stop the company using your data for targeted advertising, selling it, or profiling you for decisions with legal or similarly significant effects (N.J.S.A. § 56:8-166.10a(5)).
-
Universal opt-out signal
Companies that use personal data for targeted ads or sell it must let you opt out through a universal opt-out mechanism you choose, such as a browser setting. The law says this applies from 6 months after its effective date, so from about July 2025 (N.J.S.A. § 56:8-166.6).
-
Withdraw consent
Withdrawing consent must be as easy as giving it, and the company must stop the processing within 15 days (N.J.S.A. § 56:8-166.12a(7)).
-
Consent for teens
If a company knows or willfully ignores that you're 13 to 16, it needs your consent before using your data for targeted ads, selling it or profiling you (N.J.S.A. § 56:8-166.12a(8)).
-
Appeal
Appeal a refusal through the company's appeal process. It must answer in writing within 45 days and, if it still says no, give you a way to contact the Division of Consumer Affairs to complain (N.J.S.A. § 56:8-166.7).
General information, not legal advice.
How to use it
- 1
Turn on a universal opt-out signal
For targeted ads and sales, switch on a universal opt-out signal such as Global Privacy Control in a browser or extension that supports it. Companies that do targeted advertising or sell data must honor a mechanism you've chosen. A browser setting, extension or device setting can also act as your authorized agent for opting out.
- 2
Send a request through the privacy notice
For access, correction, deletion or a copy, use the method in the company's privacy notice. Say you're using your rights under the New Jersey Data Privacy Act. A line like "Under N.J.S.A. § 56:8-166.10, please delete the personal data you hold about me" is enough to start.
- 3
Confirm your identity if asked
The 45-day clock runs from a verified request, so the company may ask for information to confirm it's you.
- 4
Wait up to 45 days
The company has 45 days to answer, or up to 90 if it tells you within the first 45 days that it needs more time and why.
- 5
Appeal if the company refuses
Use the company's appeal process and keep a copy. It must decide in writing within 45 days.
- 6
Complain to the Division of Consumer Affairs
If the appeal is denied, the company must give you an online way or another method to contact the Division of Consumer Affairs. You can also go to the Division of Consumer Affairs website and use its complaint route there. Attach the refusal and your appeal.
No answer in time? Complain to New Jersey Office of the Attorney General, Division of Consumer Affairs .
The 2026 data broker law (registry coming, not live)
On June 30, 2026, New Jersey approved P.L.2026, c.25, which took effect immediately. It does two big things.
First, sensitive data. Data brokers and data collectors may not sell or license it, and no company may sell it, whatever its size. The penalty is $50,000 per record.
Second, registration. Data brokers and data collectors that sell or license New Jersey consumers' personal data must register each year with the Division of Consumer Affairs and pay a fee from $5,000 to $1,500,000, depending on how many New Jersey consumers' data they hold. A broker that fails to register or update its details owes $2,500 a day. The Division must keep a public registry with each broker's contact details, privacy policy and opt-out information.
That registry part doesn't operate until 270 days after the law's approval, which works out to about late March 2027. No official registry page exists yet. Until it does, there's no state list to check, and you find and contact each broker yourself.
Dates, as the law words them
The statute counts from events rather than naming calendar dates, so these are worked out from its text:
- About mid-January 2025: the law took effect, 365 days after its January 16, 2024 approval.
- About July 2025: companies that do targeted ads or sell data had to start honoring universal opt-out signals, 6 months after the effective date.
- About July 2026: the 30-day cure period ended, on the first day of the 18th month after the effective date.
- About late March 2027: the public data broker registry starts operating, 270 days after June 30, 2026.
Who has to follow it
A company is covered if it does business in New Jersey or targets its residents and handles data on at least 100,000 consumers a year. Data used only to complete a payment doesn't count. At 25,000 consumers it's covered if it makes money or gets a discount from selling personal data.
Why a company can say no
State agencies and political subdivisions are exempt. Financial institutions covered by the Gramm-Leach-Bliley Act (GLBA) and their data are exempt, and so are insurance institutions subject to New Jersey's P.L.1985, c.179. Some data is outside the law whoever holds it: HIPAA-protected health information, consumer report data as the Fair Credit Reporting Act (FCRA) allows, and sales of motor vehicle records by the Motor Vehicle Commission that the Driver's Privacy Protection Act permits.
If a company tells you your data falls under the FCRA or GLBA, that's the likely reason it's declining. You can still appeal, and complain to the Division of Consumer Affairs if the refusal looks wrong. Our guide on what to do when a company won't delete your account covers the next steps.
Where Serus fits
Until the registry is live, New Jersey's law works one company at a time, and you first have to know which brokers hold your data. Serus finds the data brokers and people-search sites that list you where you live and sends the deletion and opt-out requests for you. Then it keeps checking. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did the New Jersey Data Privacy Act take effect?
The law was approved on January 16, 2024 and says it takes effect on the 365th day after enactment, which works out to about mid-January 2025.
Do companies have to honor a universal opt-out signal in New Jersey?
Yes, if they do targeted advertising or sell personal data. The law says they must honor a universal opt-out mechanism you choose from 6 months after the law's effective date, which works out to about July 2025.
Is there a New Jersey data broker registry?
It's coming. A 2026 law (P.L.2026, c.25), approved on June 30, 2026, requires data brokers and data collectors to register with the Division of Consumer Affairs each year. The part that sets up the public registry doesn't operate until 270 days after approval, which works out to about late March 2027.
Can data brokers sell my sensitive data in New Jersey?
No. Since June 30, 2026, data brokers and data collectors may not sell or license sensitive data, and no company may sell sensitive data whatever its size. The penalty is $50,000 per record.
Can I sue under the NJDPA?
No. The Attorney General has sole and exclusive enforcement authority, and the law doesn't give you a private right of action.
Do companies still get a chance to fix violations?
Not any more, by the law's own timing. It required a 30-day notice to fix a violation, where a fix was possible, until the first day of the 18th month after the law took effect. That works out to about July 2026.
Sources
Something wrong or out of date? Tell us and we'll re-check it.