New Jersey Data Privacy Law (NJDPA): What New Jersey Residents Need to Know

New Jersey's privacy law — the New Jersey Data Privacy Act (NJDPA) — took effect on January 15, 2025. If you are a New Jersey resident, this law gives you broad rights over your personal data and requires businesses — including data brokers — to honor deletion and opt-out requests.

What Is the New Jersey Data Privacy Act?

Governor Phil Murphy signed the New Jersey Data Privacy Act into law on January 16, 2024. After a one-year implementation period, it became effective January 15, 2025. New Jersey is among the most densely populated states in the nation, and its privacy law — combined with New Jersey's existing data broker registration requirements — covers personal data processing across the state through two separate regulatory frameworks.

The NJDPA applies to businesses that conduct business in New Jersey or produce products or services targeted to New Jersey residents, and during the prior calendar year either: controlled or processed personal data of 100,000 or more New Jersey consumers, excluding data processed solely for completing a payment transaction; or controlled or processed personal data of 25,000 or more New Jersey consumers and derived more than 25% of gross revenue from the sale of personal data. There is no revenue floor — businesses of any size that meet the data volume thresholds are covered.

New Jersey also has a separate data broker registration law, the Daniel's Law amendments (effective 2021), which specifically protects personal information of certain government and public safety employees. The NJDPA operates alongside this existing framework, adding a second layer of protection for New Jersey consumers.

Your Rights Under the NJDPA

New Jersey residents have five enforceable data rights under the NJDPA:

Controllers must respond to authenticated consumer rights requests within 45 days, extendable by an additional 45 days when reasonably necessary with proper notice. Consumers may submit two requests per year at no charge; businesses may charge a reasonable fee for additional requests. Retaliation against consumers for exercising their rights is prohibited.

New Jersey's Universal Opt-Out Requirement

The NJDPA requires covered businesses to honor universal opt-out mechanisms— including browser-based signals such as the Global Privacy Control (GPC). When a New Jersey consumer uses a browser with GPC enabled and visits a covered business's website, that business must treat the GPC signal as a valid opt-out of data sales and targeted advertising.

This is a real practical advantage for New Jersey consumers. Rather than navigating to each data broker's website individually to find and complete a separate opt-out form, consumers who enable GPC in their browser automatically assert their opt-out rights on every covered site they visit. New Jersey joins California, Colorado, Connecticut, and Oregon in requiring this browser-signal compliance.

How the NJDPA Compares to CCPA

What Data Brokers Must Do Under the NJDPA

Covered controllers in New Jersey must fulfill these compliance obligations:

• Publish a clear and accessible privacy notice that describes the categories of personal data collected, the purposes of processing, consumer rights and how to exercise them, how to opt out of data sales and targeted advertising, and the categories of data disclosed to third parties.
• Honor universal opt-out signals (including GPC) as a valid opt-out of data sales and targeted advertising processing. This requirement was in effect from the law's January 15, 2025 effective date.
• Obtain consent before processing sensitive data, including data on racial or ethnic origin, religious beliefs, mental or physical health, sexual orientation, citizenship status, biometric identifiers, precise geolocation, and data of individuals known to be under 13.
• Conduct and document data protection assessments for high-risk processing activities, including targeted advertising, data sales, significant profiling, and certain processing of sensitive data categories.
• Process deletion requests within 45 days and instruct processors to comply with deletion. Legitimate exceptions include data needed to complete a transaction, data required by law, or data necessary for security purposes.
• Provide a meaningful appeals process if a consumer request is denied. The appeals response must be delivered within 45 days of receipt.

Step-by-Step: How to Use the NJDPA to Delete Your Data

1. 1. Enable Global Privacy Control in your browser. New Jersey businesses must honor GPC signals. In Firefox: Settings > Privacy and Security > "Tell websites not to sell or share my data." In Brave: GPC is enabled by default. In Chrome: install the Privacy Badger or GPC extension.
2. 2. Find the data broker's privacy notice. Navigate to the website footer and look for "Privacy Policy," "New Jersey Privacy Rights," or "Your Privacy Rights." The NJDPA requires this information to be clearly accessible.
3. 3. Submit your deletion request. Use the company's designated request mechanism. State that you are a New Jersey resident exercising your rights under the New Jersey Data Privacy Act. Request deletion of all personal data the company holds about you, and opt out of data sales and targeted advertising.
4. 4. Provide identity verification. Companies may verify your identity before processing. Provide the information requested, but companies cannot require you to create an account solely for this purpose.
5. 5. Track your 45-day response window. Document when you submitted your request. If the company extends the response period, they must notify you within the initial 45 days and explain the reason.
6. 6. Appeal or escalate if necessary. If your request is denied, use the appeals process described in the denial notice. If the appeal fails, file a complaint with the New Jersey Division of Consumer Affairs or the New Jersey Attorney General at njconsumeraffairs.gov.

The NJDPA is one of the more recent and more thorough state privacy laws in the country. Its combination of universal opt-out requirements, escalating penalties for repeat violations, and data protection assessment obligations gives New Jersey residents real leverage over data brokers. Combined with CCPA coverage through authorized agents, that makes deletion requests harder for brokers to ignore. Learn more about California's CCPA or start automated removal with GhostVault.

Frequently Asked Questions