New Jersey Data Broker Registration and Sensitive Data Sale Ban (A5328)

One of the most expansive sensitive-data restrictions in the country, and the one most likely to catch a business by surprise: the ban on selling or licensing sensitive data applies to every individual and legal entity regardless of size, explicitly including businesses that fall below the NJDPA's own 100,000/25,000-consumer thresholds. Civil penalties run to $50,000 per record sold, offered for sale, or licensed. Limited carve-outs exist for HIPAA-covered entities and GLBA financial institutions. Separately, both "data brokers" and the broader category of "data collectors" must register with the NJ Division of Consumer Affairs from Mar 27, 2027, with tiered fees from $5,000 up to $1,500,000 based on consumer volume and $2,500/day penalties for failing to register.