New Jersey A 5328 - Sensitive Data Sale Ban and Data Broker Registry

Amends the New Jersey Data Privacy Act to prohibit all sales of sensitive personal data without thresholds and creates a public data broker registry operative 270 days after enactment.

JurisdictionNew Jersey
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

New Jersey A 5328 is the enacted New Jersey measure that bans the sale of sensitive personal data without the usual NJDPA thresholds and creates a public data broker/data collector registry administered by the Division of Consumer Affairs. The bill text shows the registry requirement and the expanded scope for selling or licensing personal data, and the legislative materials indicate the registry is meant to be public and updated regularly.[1][2][3]

Key Requirements

  • Blanket ban on selling sensitive personal data
  • A 5328 amends the New Jersey Data Privacy Act to prohibit the sale of sensitive data; legislative summaries and practitioner analyses indicate the prohibition is not limited by the NJDPA’s normal applicability thresholds, so it reaches entities that otherwise would not be subject to the NJDPA.[1][2][3]
  • The bill’s operative text and related summaries describe the restriction as applying to the sale, offer for sale, and licensing of sensitive data.[1][2][3]
  • Public registry for data brokers and data collectors
  • The Division of Consumer Affairs in the Department of Law and Public Safety must establish and maintain a public registry of data brokers and data collectors engaged in selling or licensing personal data of New Jersey consumers.[1][4]
  • The registry must include, at minimum, the entity’s name, physical address, general email address, website, privacy-policy URL, and opt-out information.[1][4]
  • Annual registration obligation
  • The bill requires covered data brokers and data collectors to register annually with the Division and pay a fee set by the statute’s fee schedule, according to the bill and legislative statement materials.[4][5]
  • Registry updates and ongoing administration
  • The division is required to review and update registry information at least annually.[5]
  • The public-facing nature of the registry and the annual update requirement are intended to improve transparency about entities that monetize New Jersey consumers’ data.[1][5]
  • Effective date structure
  • Practitioner analyses report that the sensitive-data sale ban took effect immediately on enactment, while the registry provisions take effect 270 days after enactment, which is reflected in the public commentary on the law.[3][6]

Compliance Challenges

  • Identifying whether data is “sensitive”
  • A major challenge is mapping internal datasets to the statutory definition of sensitive data, because organizations often store mixed datasets containing both ordinary personal data and sensitive attributes.[3][6]
  • This classification problem is commonly highlighted in privacy compliance programs because business teams, ad-tech vendors, and analytics systems often do not label sensitivity consistently.[6][7]
  • Finding all sale and licensing flows
  • Companies must trace direct and indirect monetization paths, including data-sharing arrangements, vendor downstream transfers, and licensed data products, because the statute reaches “sale” and “licensing” activity.[1][2][3]
  • Industry commentary warns that organizations often discover hidden resale relationships only after contract inventory and data-flow mapping exercises.[6][7]
  • Separating NJDPA scope from A 5328 scope
  • Another challenge is that A 5328’s sensitive-data restriction is described as broader than the ordinary NJDPA applicability thresholds, so teams cannot rely only on the usual NJDPA coverage analysis.[2][3]
  • That means some organizations that believed they were outside the NJDPA may still need to stop sensitive-data sales and evaluate registry status.[2][3]
  • Determining registry status as a data broker or data collector
  • Organizations must assess whether they fit the bill’s definitions of data broker or data collector, which can be difficult for enterprises with hybrid operating models, affiliate sharing, or consumer-facing services combined with data monetization.[1][4]
  • Legal analysis notes that New Jersey’s registry is unusually broad because it covers not only data brokers but also certain data collectors that sell to brokers.[1][6]
  • Operationalizing consumer-facing disclosures and opt-outs
  • The registry requires public disclosure of privacy-policy and opt-out information, so companies need consistent external notices and internal workflows to honor deletion, access, and opt-out requests where applicable.[1][4]
  • Privacy teams commonly face coordination issues between legal, marketing, engineering, and customer support when building these notice-and-request processes.[7][8]
  • Fee, registration, and reporting administration
  • Annual registration plus fee calculation adds an administrative burden, especially for firms with multiple legal entities, different consumer-volume tiers, or complex data products.[4][5][6]

Implementation Best Practices

  • Build a sensitive-data inventory
  • Create a complete inventory of datasets that may contain sensitive data, then tag them by sensitivity category, business purpose, retention period, and downstream disclosure path.[3][6]
  • Use established privacy-management frameworks such as the NIST Privacy Framework and the NIST Cybersecurity Framework to structure this inventory work.[9][10]
  • Map all data sales and licensing relationships
  • Perform a contract-by-contract review of data-sharing, licensing, and monetization arrangements to determine whether any flow qualifies as a prohibited sale of sensitive data.[1][2][3]
  • Include affiliates, processors, resellers, SDK providers, and ad-tech partners in the mapping exercise because hidden transfer chains are a common source of noncompliance.[6][7]
  • Update external notices and consent/opt-out workflows
  • Align consumer notices, privacy policies, and opt-out mechanisms with the statute’s transparency requirements, especially where the business is likely to appear in the public registry.[1][4]
  • The IAPP privacy management guidance and NIST Privacy Framework are practical references for governance, notice, and data-processing controls.[9][11]
  • Prepare registry-readiness documentation
  • Maintain ready-to-file documentation for business name, address, privacy-policy URL, general email, opt-out channel, and any required operational disclosures so annual registration can be completed without delay.[1][4][5]
  • A centralized compliance recordkeeping system reduces the risk of inconsistent submissions across subsidiaries.[5][6]
  • Create a cross-functional governance process
  • Establish a review board involving legal, privacy, security, procurement, product, and marketing to approve any new data monetization arrangement before launch.[7][9]
  • This governance model is consistent with the control-oriented approach recommended in NIST privacy and cybersecurity guidance.[9][10]
  • Use privacy engineering and vendor-management tools
  • Implement data mapping, vendor risk, and records-of-processing tools to maintain evidence of compliance and to support registry updates.[9][11]
  • Common implementation resources include the NIST Privacy Framework, NIST Cybersecurity Framework, and the IAPP’s privacy management materials.[9][10][11]

Recent Updates

  • Enactment and statutory change
  • A 5328 was enacted in 2026 and is described in practitioner coverage as amending the NJDPA to impose a blanket ban on the sale of sensitive data and create the registry regime.[3][6]
  • Effective date for the sale ban
  • Practitioner summaries indicate the sensitive-data sale prohibition took effect immediately upon enactment.[3][6]
  • Registry effective date
  • Practitioner summaries indicate the data broker/data collector registry provisions become operative 270 days after enactment, which places implementation timing in March 2027 based on the reported enactment date.[3][6]
  • Annual registration and update cycle
  • Legislative materials state that the division must review and update registry information at least annually, and covered entities must register annually.[4][5]
  • No later official amendment identified in the available materials
  • Based on the sources gathered here, I do not have a later official amendment, repeal, or implementing regulation to report beyond the enacted law and the legislative bill materials.[1][2][3]

Related Regulations

  • New Jersey Data Privacy Act
  • A 5328 is an amendment to the New Jersey Data Privacy Act, so NJDPA concepts such as personal data, consumer rights, and controller obligations still matter when evaluating compliance.[2][3]
  • Official bill materials from the New Jersey Legislature are the primary source for the amendment text and its interaction with the NJDPA.[1][2][4]
  • California Delete Act
  • California’s data broker registry model is a relevant comparator because New Jersey’s registry is similar in concept, although New Jersey’s approach also covers certain data collectors.[6][7]
  • The California Attorney General’s official privacy materials are the primary source for California’s data broker registration framework.[12]
  • Vermont Data Broker law
  • Vermont’s data broker registry is another relevant analogue because it established an early state-level registration regime for data brokers.[6][12]
  • Vermont’s official data broker registry statute and guidance are the primary source for that comparison.[13]
  • Oregon and Texas data broker laws
  • New Jersey’s law is commonly compared to Oregon and Texas because those states also regulate data brokers through registration and disclosure obligations.[6][7]
  • Official state sources for Oregon and Texas data broker requirements are the primary references for cross-state comparison.[14][15]
  • NIST Privacy Framework
  • The NIST Privacy Framework is not a law, but it is a widely used implementation framework for data mapping, governance, and risk management that can support compliance with A 5328.[9]
  • NIST Cybersecurity Framework materials also help organizations document controls around data inventories and third-party governance.[10]

Industry Impact

  • Broad impact beyond traditional data brokers
  • The law’s reported reach beyond ordinary NJDPA thresholds means smaller businesses and businesses that do not consider themselves “privacy law-covered” may still need to change data-sale practices.[2][3][6]
  • This is especially significant for ad-tech, data analytics, lead generation, health-adjacent services, and consumer data marketplaces.[6][7]
  • Pressure on ad-tech and data monetization models
  • Industry analyses note that a blanket ban on sensitive-data sales reduces the viability of certain targeted advertising and audience-segmentation products, especially where sensitive attributes are inferred or packaged into downstream datasets.[6][7]
  • Higher compliance costs
  • Annual registration, legal classification work, public disclosures, and data-flow remediation increase compliance costs for organizations that sell or license consumer data.[4][5][6]
  • Practitioner commentary expects these costs to be felt most acutely by mid-market firms that have limited privacy staff but significant data-sharing ecosystems.[6][7]
  • Reputational exposure from public registry listing
  • Because the registry is public, listed entities may face increased scrutiny from consumers, regulators, partners, and plaintiffs’ counsel.[1][4]
  • Public registry models generally increase transparency but also amplify reputational and contractual diligence demands.[6][12]
  • Contract and vendor renegotiations
  • Organizations may need to renegotiate vendor terms, eliminate sensitive-data resale clauses, and add warranties and audit rights to assure downstream compliance.[6][7]
  • This can have ripple effects across marketing, identity resolution, and data enrichment partnerships.[6][7]

Sources

If you want, I can turn this into a board-ready compliance memo or a control checklist mapped to legal, security, and vendor-management tasks.

Recent developments

  • — New Jersey A 5328 is analyzed as a sweeping ban on the **sale or licensing of sensitive data** by all individuals and entities, with a new **public registry for data brokers and data collectors** and a fee schedule ranging from $5,000 to $1.5 million based on consumer volume; the registry provisions take effect March 27, 2027.[1] (source)
  • — A fiscal note on A 5328 details the **annual registration fees** for data brokers and data collectors and emphasizes that each covered entity must register with the Division of Consumer Affairs and pay fees according to volume tiers, with **civil penalties of $50,000 per record** sold, offered, or licensed in violation, underscoring substantial compliance and enforcement risks.[9] (source)
  • — Industry commentary for marketers highlights that New Jersey’s data broker law covers companies that **sell or license personal data to data brokers**, including brands with direct customer relationships, and warns that the forthcoming registry (targeted for April 1, 2027) and sensitive data ban will significantly impact **digital marketing, audience segmentation, and data partnerships**.[13] (source)
  • — A law firm update explains that Governor Sherrill signed A 5328 on June 30, 2026, **banning the sale of sensitive consumer data** by nearly all entities (with limited HIPAA and GLBA exceptions) and requiring data brokers and data collectors to **register and pay substantial fees**, with the registry expected to launch in spring 2027 and **penalties of $2,500 per day** for noncompliance.[8] (source)
  • — A WilmerHale analysis describes A 5328 as establishing a **data broker registration regime** plus a broad prohibition on **sensitive data sales** not only by data brokers and data collectors but also by entities operating in New Jersey generally, noting a **$50,000 civil penalty per sensitive data record** sold or licensed in violation.[2] (source)
  • — A Freshfields update outlines New Jersey’s new privacy rules, emphasizing a **complete prohibition on selling or licensing sensitive data** that applies across data brokers, data collectors, and controllers, and reporting a July 13, 2026 Division of Consumer Affairs alert that entities **will not need to register or pay fees until the registry launches in spring 2027**, clarifying timing for compliance planning.[10] (source)
  • — An industry-focused commentary stresses that while the **registry and fee obligations are deferred until 2027**, the **sensitive data restrictions are already active and enforceable**, warning data brokers, data collectors, and brands that they cannot rely on “pause” narratives and must **immediately adjust data sale and licensing practices**.[12] (source)
  • — ZwillGen characterizes A 5328 as “one of the most onerous and sweeping data broker regimes” in the U.S., noting that entities qualifying as data brokers or selling their own consumer information must **register and pay hefty annual fees**, and explaining that the **ban on sensitive data sales took effect immediately**, while registration requirements start March 27, 2027, driving significant **compliance and business-model impacts**.[5] (source)
  • — The IAPP reports that Governor Mikie Sherrill signed A 5328 on June 30, 2026, making New Jersey the **seventh state with a data broker law**, with immediate effect for most provisions and a delayed effective date of **March 27, 2027 for the registry**, and discusses how the **costly fee and penalty structure** is prompting concern among privacy professionals and data broker businesses.[11] (source)
  • — The introduced bill text for A 5328 shows that it **prohibits commercial website and online service controllers from selling sensitive data** regardless of consumer-count thresholds and directs the Division of Consumer Affairs to establish and maintain a **public registry of data brokers and data collectors** selling or licensing New Jersey consumers’ personal data, including detailed contact, privacy policy, and opt-out information, thereby formalizing the new regulatory obligations.[4] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates