NJDPA

New Jersey's law took effect January 15, 2025 and has required recognition of universal opt-out mechanisms since July 15, 2025. It applies to controllers handling data on 100,000 consumers, or 25,000 where the controller derives revenue from selling personal data. Consumers may opt out of targeted advertising, sale, and profiling, and the law requires opt-in consent before targeted advertising or sale involving consumers aged 13 to 16. Financial data is sensitive, and since June 30, 2026 a separate statute has banned anyone from selling sensitive data, with or without consent, at $50,000 per record. The Division of Consumer Affairs within the Attorney General's office enforces and has rulemaking authority. The 30-day cure period expired July 15, 2026. New Jersey's revenue-from-sale trigger has no minimum percentage, so incidental data sales through advertising tags can bring a mid-sized company into scope.