New Jersey's Data Broker Registry Law (2026): What It Means for You
On June 30, 2026, New Jersey enacted P.L.2026, c.25 (bill A5328). It makes data brokers register with the state, charges some of the highest registration fees in the country, and bans the sale of sensitive data outright. It does not create a new right to delete your data, because New Jersey residents already have one. Here is what the statute says and what it means for you.
The Short Version
- In effect now: the law took effect on enactment. Data brokers, and the companies that sell data to them, must register every year with the Division of Consumer Affairs.
- Fees: from $5,000 to $1,500,000 a year, based on how many New Jersey residents are in the data.
- Sensitive data: no business may sell it. Brokers that do face $50,000 per record.
- Public registry: held back for 270 days after enactment, so late March 2027.
- Deleting your data: still done under the New Jersey Data Privacy Act, in effect since January 15, 2025.
Who Has to Register
A data broker is a person or company that knowingly collects or buys the personal data of a New Jersey resident it has no direct relationship with, and sells or licenses that data to a third party. Being a customer, subscriber, user, employee, contractor, investor or donor counts as a direct relationship.
The law also covers data collectors: businesses that collect your data through a direct relationship and then sell or license it to a data broker. That second category is unusual. It reaches the apps and retailers that feed the broker market, not only the brokers.
Some businesses are carved out when the data activity is incidental, such as running an e-commerce or app platform, or 411 directory assistance.
The Fee Schedule
| New Jersey consumers in the data | Annual fee |
|---|---|
| 100,000 or fewer | $5,000 |
| 100,000 to 500,000 | $10,000 |
| 500,000 to 1 million | $100,000 |
| 1 million to 1.5 million | $500,000 |
| 1.5 million to 2.5 million | $750,000 |
| 2.5 million to 4.5 million | $1,000,000 |
| More than 4.5 million | $1,500,000 |
For comparison, Vermont's fee rises to $900 a year in 2027. A large national broker holding most New Jersey adults would owe New Jersey over a thousand times that.
What Brokers Must Tell the State
At registration, and at least once a year after, each broker or collector reports:
- Name, address, email and website.
- Whether you can opt out, how, what the opt-out covers, and whether you can authorize someone else to opt out for you.
- Whether you can direct it to delete your personal data.
- What collection or sales you cannot opt out of.
- Whether it vets the people who buy its data.
- Its history of data breaches, including how many people each affected. The division may not publish this part.
- Its practices for data about people under 18.
- The processors that handle data on its behalf.
The Public Registry
The Department of Law and Public Safety must keep a public registry listing each broker and collector's name, address, a contact email for privacy questions, its website, its privacy policy page, and opt-out information. That provision stays inoperative for 270 days after June 30, 2026, which lands in late March 2027. Once it is live, it becomes a list of companies to send requests to.
The Sensitive Data Ban
The law amends the New Jersey Data Privacy Act so that a business may not sell sensitive data, and that rule applies regardless of how many consumers' data it holds. The NJDPA defines sensitive data, and it includes categories such as health information, precise location and data about children. A data broker or data collector that sells, offers for sale or licenses sensitive data in violation faces a civil penalty of $50,000 for each record.
Penalties for Not Registering
- Failing to register or pay: the fees owed plus $2,500 for each day.
- Failing to submit or update the required information: $2,500 for each day.
How to Get Your Data Deleted in New Jersey
- Use the NJDPA. State that you are a New Jersey resident exercising your right to delete under the New Jersey Data Privacy Act. Our NJDPA guide covers deadlines and appeals.
- Write it once. The free deletion letter generator drafts the request.
- Start with people-search sites, which publish your address and phone to anyone. Steps for each are in our free opt-out guides.
- Keep every reply. If a broker ignores you, the date of your request and its silence are your evidence.
Where GhostVault fits
GhostVault sends deletion requests to registered data brokers, citing your state's law, follows up when they stay silent, and shows you each broker's written reply. A request is not a removal until the broker confirms it. The free scan shows where you are listed today. First month $1, then $7.99/mo. Cancel anytime.
Frequently Asked Questions
Is this the same as Daniel's Law?
No. Daniel's Law protects the home addresses and phone numbers of judges, prosecutors, police and certain other covered people. P.L.2026, c.25 is a general registration law for data brokers and the businesses that sell to them.
When will I be able to search the registry?
The public registry provision becomes operative 270 days after June 30, 2026, so late March 2027. The division may set its own launch details by rule.
Does the law apply to brokers outside New Jersey?
Yes, if they sell or license the personal data of New Jersey consumers. What matters is whose data it is, not where the business is based.
Where can I read the law?
The approved text is on the New Jersey Legislature's site.