News

New Jersey has enacted one of the strictest data broker laws in the United States. On June 30, 2026, the governor signed Senate Bill 2316, which bans data brokers from selling sensitive personal data and requires them to register with the state. According to the Electronic Privacy Information Center (EPIC), the law makes New Jersey the seventh state to pass a data broker law, and the second to do so this year after Connecticut.

What a data broker is, and why this law matters

A data broker is a company that collects personal information about people, often without their knowledge, and packages or sells it to others. The raw material is data you rarely hand over directly: it is scraped, bought from apps and websites, or assembled from public and commercial records into detailed profiles that are then traded.

The privacy problem is not just that this happens, but what gets sold. When the data that reveals your health, your finances, or where you physically go is put up for sale, a leak or a bad buyer can expose the most intimate parts of your life. New Jersey's law is aimed squarely at that category of information.

What the New Jersey law bans

The core of the law is a ban on brokers of any size selling sensitive data. As described by EPIC and legal analysts covering the bill, that includes personal data revealing race or ethnic origin, health conditions, financial information, sexual orientation and immigration status, along with genetic, biometric and geolocation data.

• New Jersey signed Senate Bill 2316 on June 30, 2026
• It bans data brokers of any size from selling sensitive data
• Covered data: race or ethnic origin, health, finances, sexual orientation, immigration status, genetic, biometric and geolocation data
• Selling sensitive data carries a $50,000-per-record fine
• Brokers must register; annual fees run $5,000 to $1.5 million, the highest in the nation
• Most of the law is effective now; the public registry follows on March 27, 2027

The prohibition has real teeth. Violations of the ban on selling sensitive data carry a fine of $50,000 per record, a figure that can add up quickly given that brokers handle information on millions of people. It turns a quiet, invisible trade into a concrete legal liability.

A public registry with the nation's highest fees

The second pillar is transparency through registration. The law directs the Division of Consumer Affairs, within the Department of Law and Public Safety, to establish and maintain a public registry of data brokers and data collectors, so that the companies trading in personal data can no longer operate entirely in the shadows.

Registration is not a formality. According to analysts, the annual fees are the highest of any state, scaling with how much data a broker holds: from $5,000 for brokers with data on fewer than 100,000 New Jersey residents up to $1.5 million for those holding data on more than 4.5 million of the state's residents.

Part of a wider state-by-state wave

New Jersey is not acting in isolation. It is the seventh state to enact a data broker law and, per EPIC, the second this year following Connecticut. With no comprehensive federal privacy law in the United States, this state-by-state momentum is how meaningful limits on the data trade are being built, one legislature at a time.

What it means for your data

The ban and the registration duties take effect immediately, with one exception: the requirement for the state to build the public registry takes effect 270 days after enactment, on March 27, 2027. You do not have to wait for that to reduce your exposure. Sharing less data is the direct defence, and it helps to understand how the trade works and how tracking feeds it. Our explainer on what a data broker is covers the background, and our guide on how to stop websites from tracking you covers the practical steps.