New Jersey Bans Sale of Sensitive Data and Creates Public Registry for Data Brokers and Collectors

Quick Hits

• On June 30, 2026, New Jersey Governor Sherrill signed legislation that bans the sale of sensitive consumer data by nearly all individuals and entities, with limited exceptions for HIPAA-covered entities and Gramm-Leach-Bliley-covered financial institutions.
• Violators of the sensitive data sale ban face civil penalties of $50,000 for each record sold, offered for sale, or licensed.
• Data brokers and data collectors must register with the New Jersey Division of Consumer Affairs and pay fees ranging from $5,000 to $1,500,000 based on consumer volume, with registration expected to open from April to June 2027 and penalties of $2,500 per day for noncompliance.

Prohibiting the Sale of ‘Sensitive Data’

A5328 is one of the most expansive bans in the country regarding the sale of sensitive data, and may lead to unintended consequences with legitimate uses of sensitive data caught up in the broad prohibition language and the significant penalties. A5328 bans the sale of “sensitive data,” which is defined as personal data that reveals information about an individual’s:

“… racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data.”

Not limited to data brokers and data collectors alone, A5328 further modifies a portion of the New Jersey Data Protection Act, N.J.S.A. § 56:8-166.12, stating that individuals or entities may “not sell sensitive data, which shall apply to all individuals or legal entities regardless of the number of consumers whose data the individual or entity controls or processes.” Violators are subject to steep civil penalties of $50,000 “for each record sold, offered for sale, or licensed.”

A5328 maintains certain exceptions for the use of sensitive data. Among these exceptions, it does not limit the collection of protected health information by entities covered under the Health Insurance Portability and Accountability Act (HIPAA) and financial institutions and affiliates covered under the Gramm-Leach-Bliley Act.

Data Broker and Data Collector Registration

A5328 also creates a public registry for two specific groups:

• “data brokers,” who “knowingly collect[] or purchase[] the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sell[] or license[] that data to a third party”; and
• “data collectors,” who “knowingly: (1) collect the personal data of a consumer with whom the data collector has a direct relationship; and (2) sell or license such personal data to a data broker.”

The statute maintains carve-outs for what constitutes a data broker or data collector, specifically shielding persons or entities that collect or purchase personal data to, among other things, (1) maintain a “third-party e-commerce or application platform”; (2) provide “411 directory assistance or directory information services”; and (3) provide “publicly available information related to an individual’s business or profession or related to providing financial or real estate services.”

To engage in the collection or purchase of New Jersey consumers’ data, data brokers and data collectors will be required to provide the New Jersey Division of Consumer Affairs with:

• the broker’s or collector’s name, physical address, email address, and website address;
• information on whether consumers can “opt out” of the broker’s or collector’s data collection practices, the type of opt-out permitted, and whether the opt-out is limited to “certain activities”;
• whether the broker or collector uses a “credentialing process” for its data purchasers, aimed at ensuring data privacy and security;
• a history of any “data breaches and other cybersecurity events” that have affected the broker or collector, and the number of individuals affected by those events; and
• the data collection practices, databases, sales activities, and opt-out methods applicable to data from those under the age of eighteen.

Any data broker or data collector registering with the Division of Consumer Affairs will also be required to pay a fee based upon the number of consumers whose data the broker or collector sells or licenses, ranging from $5,000 (for fewer than 100,000 consumers) to $1,500,000 (for more than 4.5 million consumers). Finally, those who fail either to register or to provide any of the information required by A5328 face a penalty of $2,500 per day.

Although A5328 has been signed into law, data brokers and data collectors are not required to register or pay any fees until the registry has been formally launched. According to a July 10, 2026, post by the Division of Consumer Affairs, the registry is expected to debut in Spring 2027, with registration running from April to June 2027. In advance of this date, the Division of Consumer Affairs intends to issue additional information regarding registration.

Ogletree Deakins’ Cybersecurity and Privacy Practice Group and Morristown office will continue to monitor developments and will post updates on the Cybersecurity and Privacy and New Jersey blogs as additional information becomes available.

Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts