On June 30, 2026, New Jersey Governor Mikie Sherrill signed A5328 into law — the most sweeping data broker regulation in the United States. The law immediately prohibits the sale of sensitive personal data about New Jersey residents (with $50,000 penalties per record), and creates a public registry that will require data brokers and data collectors to register and pay annual fees from $5,000 to $1.5 million starting April 1, 2027. Here's what changed, what it means for your personal information, and how to exercise your new rights.
What A5328 Actually Does
A5328 is not an amendment to New Jersey's existing consumer privacy law (the NJDPA). It's a separate, additional statute that regulates the data broker industry directly. Legal analysts at Troutman, Wiley, Faegre Drinker, and Hunton Andrews Kurth have called it the most comprehensive data broker regime adopted in any U.S. state to date — stricter than California's Delete Act.
The law does three big things:
- Bans the sale, offer for sale, or licensing of "sensitive personal data" about New Jersey consumers — for every entity, with no consumer-consent workaround.
- Creates a public data broker and data collector registry maintained by the New Jersey Division of Consumer Affairs.
- Imposes annual registration fees ranging from $5,000 to $1.5 million, scaled by the number of New Jersey consumers whose data a company sells or licenses.
The Sensitive Data Ban Applies to Everyone
Unlike California's Delete Act, which only regulates registered data brokers, New Jersey's sensitive-data prohibition applies to nearly all individuals and entities. The only carve-outs are HIPAA-covered health entities and financial institutions covered by the Gramm-Leach-Bliley Act. Advertisers, ad tech firms, retailers, apps, and B2B contact providers are all in scope.
What Counts as "Sensitive Personal Data" Under A5328
The definition tracks other 2026 state privacy laws but is enforced with much sharper teeth. Sensitive personal data includes:
- Racial or ethnic origin
- Religious or philosophical beliefs
- Mental or physical health condition, diagnosis, or treatment
- Sex life or sexual orientation
- Citizenship or immigration status
- Genetic or biometric data (fingerprints, voiceprints, face geometry)
- Precise geolocation data (typically within 1,850 feet)
- Personal data of a known child under 13
- Financial account information (account, debit, credit card numbers with any required security or access code)
- Government-issued identifiers (SSN, driver's license, passport)
If a company sells, offers for sale, or licenses any of this data about a New Jersey resident on or after June 30, 2026, it faces civil penalties of $50,000 per record. A single leaked list of 1,000 New Jersey consumers exposes a seller to $50 million in penalties before any private plaintiff joins the case.
How the Data Broker Registry Works
Every data broker and data collector that sells or licenses New Jersey consumer data must register with the Division of Consumer Affairs. Registration is broader than most states — it captures not just traditional "brokers" but also "data collectors," defined broadly enough to sweep in many businesses that assemble consumer datasets even if they aren't the ones ultimately selling them.
Step 1: Registration Window Opens April 1, 2027
Companies must submit their initial registration between April 1 and June 30, 2027. The Division published its implementation timeline on July 10, 2026, confirming these dates. Missing the window triggers a $2,500-per-day penalty until registration is complete.
Step 2: Fees Scale With Consumer Volume
Annual registration fees are tiered by how many New Jersey consumers a company holds data on:
- ≤ 100,000 consumers: $5,000/year
- 100,001 – 500,000 consumers: $50,000/year
- 500,001 – 1 million consumers: $150,000/year
- 1 – 2.5 million consumers: $500,000/year
- 2.5 – 4.5 million consumers: $1,000,000/year
- > 4.5 million consumers: $1,500,000/year
By comparison, California's data broker registration fee is a flat $6,600 for most brokers. New Jersey's top tier is more than 225 times that — the reason lawyers are calling A5328 "the nation's costliest data broker law yet."
Step 3: Public Disclosure of Data Practices
Registered brokers must publicly disclose the categories of personal data they collect, the categories of sources they collect from, how consumers can exercise deletion and opt-out rights, and any material breaches in the past year. The registry itself will be searchable by any New Jersey resident.
How A5328 Compares to California's Delete Act
Both laws create a public data broker registry, but they take fundamentally different approaches to protecting consumers:
- California: Regulates only registered data brokers. Requires them to honor a universal deletion request through the DROP platform starting August 1, 2026. Registration fee is roughly $6,600.
- New Jersey: Bans the sale of sensitive data by almost every entity, not just registered brokers. Registration fees run to $1.5 million. No universal deletion platform yet, but individual deletion rights are enforceable through the Division of Consumer Affairs.
The practical effect: California uses centralized deletion as its main lever, while New Jersey uses outright bans on sensitive-data commerce plus enormous fees on the industry.
New Jersey Consumers Now Have Two Overlapping Rights Regimes
The New Jersey Data Privacy Act (NJDPA), effective January 15, 2025, still applies — including the right to know, correct, delete, and opt out of sales, targeted advertising, and profiling. A5328 adds an outright ban on sensitive data sales plus the registry framework. Use both together to maximize protection.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
What This Means for New Jersey Residents
You don't have to wait for the 2027 registration window to benefit. The sensitive-data sale ban is already in effect. In practical terms:
- Data brokers legally cannot sell your precise geolocation, health, sexual orientation, immigration status, or biometric data — even if you previously consented on some app or website. There is no consent exception in the statute.
- You can file complaints with the New Jersey Division of Consumer Affairs at njconsumeraffairs.gov if you find your sensitive data being sold or listed.
- Existing NJDPA rights still apply — you can demand deletion of non-sensitive personal data (name, address, phone, marketing profile) from any qualifying business, with a 15-day opt-out processing requirement that is faster than any other state.
- The registry, when live in mid-2027, will let you look up which brokers hold data on New Jersey consumers and where to send removal requests.
How to Exercise Your Rights Today
Step 1: Send Sensitive-Data Deletion Demands
Identify the companies most likely holding your sensitive data — health apps, dating apps, ad-tech firms, location-tracking services, people-search sites that display biometric-linked info. Cite A5328 explicitly when demanding deletion, and warn of the $50,000-per-record civil penalty exposure if they continue to offer your sensitive data for sale.
Step 2: Opt Out of Every Major People-Search Site
People-search sites (Spokeo, BeenVerified, Whitepages, TruePeopleSearch, Radaris, PeekYou, Intelius, MyLife, and dozens more) are the most visible layer of the data broker economy. Each has its own opt-out process. See our complete people-search opt-out guide.
Step 3: Enable Global Privacy Control
Under the NJDPA, businesses must recognize the Global Privacy Control (GPC) browser signal. Enable it in Firefox, Brave, or via a Chrome extension. Once enabled, every website you visit automatically receives an opt-out-of-sale request.
Step 4: File Complaints on Ignored Requests
If a company ignores a deletion or opt-out request beyond the required timeframe, file a complaint with the New Jersey Division of Consumer Affairs. Under A5328, violations are enforceable as unlawful practices, with civil penalties available.
Sensitive Data Already Sold Before June 30, 2026
A5328 does not retroactively unwind sales that occurred before it took effect. Data brokers that already licensed your sensitive information to third parties can continue holding it — you must submit deletion requests to each downstream buyer separately. This is why automated broker removal that continuously monitors and re-submits is more useful than a one-time cleanup.
How PrivacyOn Helps New Jersey Residents Enforce A5328
The gap between having strong privacy rights on paper and actually removing your data from the broker economy is enormous. A5328 gives New Jersey residents unprecedented leverage — but you still have to exercise it, broker by broker, and re-exercise it every time a broker relists your profile from fresh public-records feeds.
PrivacyOn is our top pick for automating this work across New Jersey and every other state. PrivacyOn submits removal requests across 100+ data broker sites, continuously monitors for relistings, tracks responses, and re-files whenever brokers add you back. Combined with 24/7 dark web monitoring and family plans covering up to 5 people, PrivacyOn turns A5328's promise into a set-and-forget reality — starting at $8.33/month. Run a free scan to see which brokers currently expose your data before you send your first deletion demand.
Frequently Asked Questions
When did New Jersey's data broker law take effect?
Governor Mikie Sherrill signed A5328 into law on June 30, 2026. The sensitive-data sale prohibition took effect immediately upon enactment. Data broker registration opens April 1, 2027, and must be completed by June 30, 2027.
Does A5328 apply to companies outside New Jersey?
Yes. Any company that sells, offers for sale, or licenses sensitive personal data about a New Jersey resident is covered — regardless of where the company is located. This mirrors how the CCPA reaches national companies serving California residents.
What are the penalties for violating A5328?
Selling, offering for sale, or licensing sensitive personal data about a New Jersey consumer triggers a civil penalty of $50,000 per record. Failing to register as a data broker or data collector triggers a $2,500-per-day penalty. Enforcement is handled by the New Jersey Division of Consumer Affairs, which can also bring actions under the Consumer Fraud Act.
Is New Jersey's law stricter than California's Delete Act?
In several ways, yes. California's Delete Act regulates only registered data brokers; New Jersey's sensitive-data sale ban applies to nearly every entity. California's broker fee is roughly $6,600; New Jersey's top-tier fee is $1.5 million. California uses the DROP platform for centralized deletion; New Jersey relies on statutory bans and direct enforcement. The two laws are complementary — residents of both states benefit from the strongest combination of consumer rights available in the U.S. today.
How do I know if a data broker is selling my sensitive data?
Search your name on major people-search sites (Spokeo, BeenVerified, Whitepages) and check what categories they display. Review privacy policies of health apps, dating apps, and location-based services you have used. For the fastest overview, run PrivacyOn's free broker exposure scan — it surfaces which of 100+ brokers currently hold your data and flags sensitive-category exposure.
What's the fastest way to remove my data under New Jersey law?
Manual removal across every major broker takes 30 to 60 hours and has to be repeated because brokers relist from fresh public-records feeds. PrivacyOn automates the process — submitting A5328-compliant removal requests across 100+ brokers, monitoring, and re-filing whenever your data reappears — for $8.33/month with family coverage up to 5 people.