N.J. Stat. § 56:8-166.20: Definitions; data broker and data collector registration, fees, required information.

2. a. As used in P.L.2026, c.25 (C.56:8-166.20 et al.):

“Consumer” means an identified person who is a resident of this State acting only in an individual or household context. “Consumer” shall not include a person acting in a commercial or employment context.

“Data broker” means a person or legal entity, including, but not limited to, a controller, that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses that data to a third party. A third party shall not include a processor if licensure or disclosure of personal data to the processor is solely to process the personal data on the data broker’s or data controller’s behalf. “Data broker” shall not include a government entity, including any federal agency or State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, or any division, board, bureau, office, commission, or other instrumentality created by a political subdivision. Examples of a direct relationship include if the consumer is a past or present: (1) customer, client, subscriber, or user of the person or legal entity’s goods or services; (2) employee, contractor, or agent of the person or legal entity; (3) investor in the person or legal entity; or (4) donor to the person or legal entity.

“Data collector” means a business, or units of a business, separately or together, that knowingly: (1) collect the personal data of a consumer with whom the data collector has a direct relationship; and (2) sell or license such personal data to a data broker. “Data collector” shall not include a government entity, including any federal agency or State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, or any division, board, bureau, office, commission, or other instrumentality created by a political subdivision.

“De-identified data” means: data that cannot be reasonably used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such an individual, if the data broker or data collector that possesses the data: (1) takes reasonable measures to ensure that the data cannot be associated with an individual; (2) publicly commits to maintain and use the data only in a de-identified fashion and not to attempt to re-identify the data; and (3) contractually obligates any recipients of the information to comply with the requirements of this paragraph and enforces or otherwise ensures compliance with such obligation.

“Director” means the Director of the Division of Consumer Affairs in the Department of Law and Public Safety.

“Division” means the Division of Consumer Affairs in the Department of Law and Public Safety.

“Personal data” means any information that is linked or reasonably linkable to an identified or identifiable person. “Personal data” shall not include de-identified data or publicly available information.

“Precise geolocation data” means information derived from technology, including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. “Precise geolocation data” shall not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

“Process” or “processing” means an operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data, and also includes the actions of a data broker or data collector directing a processor to process personal data.

“Processor” means a person, private entity, public entity, agency, or other entity that solely processes personal data on behalf of the data broker or data collector.

“Publicly available information” means information that is lawfully made available from federal, State, or local government records or widely distributed media or information that a data broker or data collector has a reasonable basis to believe a consumer has lawfully made available to the general public and has not restricted to a specific audience.

“Sale” or “sell” means sharing, disclosing, or transferring personal data for monetary or other valuable consideration.

“Sensitive data” means personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data.

b. The Division of Consumer Affairs in the Department of Law and Public Safety shall establish and maintain a public registry of data brokers and data collectors engaged in selling or licensing personal data of New Jersey consumers. Using the information submitted pursuant to subsection c. of this section, the registry shall include, at a minimum, for each data broker and data collector: the data broker’s or data collector’s name and physical address; a general email address that may be used to request information about the data broker’s or data collector’s privacy policies and data collection practices; a general Internet website address for the data broker or data collector; an Internet website address specific to the data broker’s or data collector’s privacy policies; and any relevant opt-out information. The division shall review and update the information contained in the registry at least annually. The division shall not publish any information that is submitted to the division pursuant to paragraph (6) of subsection d. of this section.

c. (1) Each data broker and data collector engaged in selling or licensing personal data of New Jersey consumers shall annually register with the division and pay to the division a registration fee in accordance with paragraph (2) of this subsection. Registration fees collected pursuant to this subsection shall be used as necessary to effectuate the purposes of this act.

(2) The registration fee schedule shall be as follows for a data broker that sells or licenses, or a data collector that collects and sells or licenses to a data broker, the personal data of:

(a) 100,000 consumers or fewer in the State—$5,000;

(b) more than 100,000 and fewer than 500,000 consumers in the State—$10,000;

(c) more than 500,000 and fewer than one million consumers in the State—$100,000;

(d) more than one million and fewer than 1.5 million consumers in the State—$500,000;

(e) more than 1.5 million and fewer than 2.5 million consumers in the State—$750,000;

(f) more than 2.5 million and fewer than 4.5 million consumers in the State—$1,000,000; and

(g) more than 4.5 million consumers in the State—$1,500,000.

d. Each data broker and each data collector shall submit the following information to the division at the time of registration, which information shall be updated by the data broker or data collector at least annually, or at such other frequency as the division may require:

(1) the data broker’s or data collector’s name and primary physical, email, and Internet website addresses;

(2) whether the data broker or data collector permits individuals to opt out of the data broker’s or data collector’s collection practices, including the method for requesting an opt-out, the type of opt-out, whether the opt-out is limited to certain activities or sales, and whether the data broker or data collector permits individuals to authorize a third party to opt out on the individual’s behalf;

(3) whether the data broker or data collector permits individuals to direct the data broker or data collector to delete any personal data in the data broker’s or data collector’s possession;

(4) a statement specifying the data collection, databases, or sales activities from which an individual may not opt out;

(5) whether the data broker or data collector uses a credentialing process for purchasers of data and, if applicable, a general explanation of that process;

(6) a history of data breaches and other cybersecurity events affecting the data broker or data collector and personal data in the data broker’s or data collector’s possession, including the number of individuals affected by each data breach or cybersecurity event;

(7) a separate statement detailing the data collection practices, databases, sales activities, and opt-out methods that are applicable to the personal data of persons under the age of 18 and whether the data broker or data collector has actual knowledge that it possesses the personal data of persons under the age of 18;

(8) any information the division deems appropriate to implement the purposes of P.L.2026, c.25 (C.56:8-166.20 et al.) as identified in regulations adopted pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.); and

(9) the processors who process personal data on behalf of the data broker or data collector.

e. A person or entity that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses data to third parties shall not be considered a data broker or data collector for the purposes of this section if:

(1) the full extent to which the person or entity collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells, licenses or otherwise provides that data to third parties is incidental to conducting one or more of the following activities:

(a) developing or maintaining a third-party e-commerce or application platform;

(b) providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier;

(c) providing publicly available information related to an individual’s business or profession or related to providing financial or real estate services;

(d) providing publicly available information via real-time or near real-time alert services for health or safety purposes; or

(e) providing title and settlement services that are regulated and examined by the New Jersey Department of Banking and Insurance; or

(2) the person or entity is a nonprofit organization established to provide enrollment data reporting services on behalf of postsecondary educational institutions.

f. A person or entity that engages in one or more of the activities described in subparagraphs (a) through (d) of paragraph (1) of subsection e. of this section shall be considered a data broker or data collector for the purposes of P.L.2026, c.25 (C.56:8-166.20 et al.) if the person or entity collects and or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses data to third parties in any way that is not incidental to an activity described in subparagraphs (a) through (d) of paragraph (1) of subsection e. of this section, unless the person or entity is exempt under paragraph (2) of subsection e. of this section.

g. Nothing in this section shall apply to:

(1) protected health information collected by a covered entity or business associate subject to the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the "Health Insurance Portability and Accountability Act of 1996" (“HIPAA”), Pub.L.104-191, and the "Health Information Technology for Economic and Clinical Health Act," 42 U.S.C. s.17921 et seq.; or information treated like protected health information collected, used, or disclosed by a covered entity or business associate under HIPAA when the information is used or disclosed in accordance with HIPAA and the information is afforded all the privacy protections and security safeguards of the federal laws and implementing regulations under HIPAA;

(2) a financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal "Gramm-Leach-Bliley Act," 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder;

(3) the secondary market institutions identified in 15 U.S.C. s.6809(3)(D) and 12 C.F.R. s.1016.3(l)(3)(iii);

(4) an insurance institution subject to P.L.1985, c.179 (C.17:23A-1 et seq.);

(5) the sale of a consumer's personal data by the New Jersey Motor Vehicle Commission that is permitted by the federal "Driver’s Privacy Protection Act of 1994," 18 U.S.C. s.2721 et seq.;

(6) personal data collected, processed, sold, or disclosed by a consumer reporting agency, as defined in 15 U.S.C. s.1681a(f), if the collection, processing, sale, or disclosure of the personal data is limited, governed, and collected, maintained, disclosed, sold, communicated, or used only as authorized by the federal "Fair Credit Reporting Act," 15 U.S.C. s.1681 et seq., and implementing regulations;

(7) any State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, and any division, board, bureau, office, commission, or other instrumentality created by a political subdivision;

(8) personal data that is collected, processed, or disclosed, as part of research conducted in accordance with the Federal Policy for the protection of human subjects pursuant to 45 C.F.R. Part 46; human subjects research conducted in accordance with good clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or research conducted in accordance with the protection of human subjects pursuant to 21 C.F.R. Parts 50 and 56;

(9) an insurance-support organization as defined in section 2 of P.L.1985, c.179 (C.17:23A-2); or

(10) the person or entity is a national securities association registered pursuant to section 15A of the “Securities Exchange Act of 1934,” 15 U.S.C. s.78a et seq., and any rules or regulations promulgated thereunder.

L.2026, c.25, s.2.