New Jersey Enacts Sweeping Data Broker Law That Could Affect More Businesses Than Expected

On June 30, 2026, Governor Mikie Sherrill signed Assembly Bill 5328 (P.L.2026, c.25), establishing a comprehensive regulatory framework governing data brokers and certain businesses that sell or license personal information. While the New Jersey data broker law has garnered attention for imposing annual registration fees that can reach $1.5 million, its significance extends well beyond its cost.

Unlike similar laws enacted in California, Vermont, and Connecticut, New Jersey’s law reaches not only traditional data brokers but also many businesses that have a direct relationship with consumers and subsequently transfer personal information to third parties. As a result, companies that have never considered themselves “data brokers” may nevertheless have new registration and compliance obligations.

Why the New Jersey Data Broker Law Is So Significant

Assembly Bill 5328 is significant not simply because it creates another privacy regulation, but because it expands the types of businesses subject to state oversight. Historically, state data broker laws have targeted companies that compile consumer information from multiple sources and sell it to third parties without a direct relationship with the individuals whose data they collect.

New Jersey took a different approach. Rather than limiting the statute to traditional data brokers, the Legislature created a second category of regulated entity known as a “data collector.” In doing so, it recognized that many businesses collect personal information directly from consumers and later monetize that information through commercial arrangements with third parties. Those businesses may never describe themselves as data brokers, yet the Legislature concluded that certain data commercialization practices warrant similar oversight.

The practical implication is that businesses should focus less on what they call themselves and more on how personal information moves through their organization. A company whose primary business is retail, software development, healthcare, manufacturing, or professional services may nonetheless fall within the law if it licenses or sells consumer information in a manner contemplated by the statute.

Who Is Covered?

Understanding the statute begins with its two principal definitions. First, a “data broker” is generally a business that knowingly collects or purchases the personal information of consumers with whom it does not have a direct relationship and then sells or licenses that information to third parties. This definition largely aligns with the traditional understanding of a data broker.

The more consequential definition is that of a “data collector.” The statute generally describes a data collector as a business that has a direct relationship with consumers but later sells or licenses those consumers’ personal information to a data broker.

From a practical perspective, this distinction substantially expands the law’s reach. A business does not avoid regulation simply because it obtained personal information directly from its own customers. If that information later becomes part of a commercial transaction involving a data broker, the business may have obligations under the statute.

For many organizations, determining whether the law applies will require a careful review of existing business practices rather than a simple review of organizational structure. Customer information may be shared through marketing partnerships, affiliate relationships, customer analytics programs, lead-generation arrangements, loyalty platforms, or data licensing agreements that have developed over time. Some of those activities may warrant closer legal scrutiny under the new law.

Registration Requirements and Fees

Covered entities under the New Jersey data broker law must register annually with the State of New Jersey. Unlike other state data broker laws, New Jersey imposes a graduated registration fee based upon the number of New Jersey consumers whose personal information is sold or licensed. The annual fee ranges from $5,000 to $1.5 million, making it by far the most expensive data broker registration regime in the country.

The size of the fee underscores the importance of determining early whether registration is required. Even businesses for whom selling personal information is only an ancillary part of their operations should carefully evaluate whether the statute applies.

Restrictions on Sensitive Personal Information

Among other provisions, A5328 also prohibits certain controllers of commercial internet websites and online services from selling sensitive personal data. The restrictions apply broadly and are intended to limit the commercial transfer of information that presents heightened privacy concerns.

Companies should carefully evaluate whether the categories of information they collect—including financial information, precise geolocation data, biometric information, health-related information, and other sensitive data defined under New Jersey privacy law—are implicated by these provisions.

Organizations that rely on advertising technology, analytics providers, data licensing arrangements, affiliate marketing, or customer monetization strategies should review existing practices to determine whether modifications will be necessary before the law becomes operative.

How the New Jersey Data Broker Law Differs from the New Jersey Data Privacy Act

Many businesses have already devoted significant resources to complying with the New Jersey Data Privacy Act (NJDPA). However, compliance with the NJDPA does not necessarily satisfy the obligations imposed by A5328.

The NJDPA principally regulates how businesses collect, process, and safeguard personal information while providing consumers with various privacy rights. The new data broker law addresses a different concern, the commercial marketplace for personal information. It focuses on businesses that sell or license consumer data and imposes registration obligations, fee requirements, and restrictions on certain transactions involving sensitive information.

Accordingly, a company may be:

• Subject to the NJDPA but not the new data broker law;
• Subject to the new data broker law but not the NJDPA; or
• Subject to both statutes simultaneously.

Accordingly, businesses should view the legislation as a separate compliance obligation rather than an extension of existing privacy requirements.

Enforcement and Compliance Risks

The new law authorizes enforcement by the New Jersey Attorney General and reflects the Legislature’s continued emphasis on regulating the commercial market for consumer information. Businesses that fail to determine whether they are subject to the law—or that continue existing data-sharing practices without evaluating the statute’s requirements—could face regulatory scrutiny, enforcement actions, and significant financial exposure.

Although implementing guidance may clarify certain aspects of the statute, companies should not wait for enforcement activity before assessing their obligations. Early compliance efforts are generally less costly and less disruptive than responding to a government investigation.

Key Questions Businesses Should Be Asking Now

The law’s effective dates provide businesses with an opportunity to prepare, but that window should not be viewed as an invitation to wait. To get a head start on compliance, in-house counsel and business leaders should begin evaluating several threshold questions:

• Does the company sell or license personal information, as those terms are defined under the statute?
• Do any existing marketing, analytics, affiliate, or data licensing arrangements trigger the law?
• Does the company qualify as a “data collector,” even if it has a direct relationship with its customers?
• What categories of sensitive personal data are collected or transferred?
• Do existing vendor and commercial agreements accurately reflect the company’s data-sharing practices?
• Are current privacy notices and internal governance policies consistent with the company’s actual data flows?

For many organizations, the answers to these questions will require coordination among legal, compliance, information technology, marketing, and business operations personnel.