Independence Day surprise: New Jersey's costly new data broker law

The risks and costs of being a data broker in the United States just went up — again. On 30 June 2026, Gov. Mikie Sherrill, D-N.J., signed A 5328 into law, making New Jersey the seventh state to enact a data broker law, and the second this year, following Connecticut. The bill was introduced and signed over the course of a few days, as New Jersey's Legislature sprinted toward an end-of-fiscal-year budget deadline.

This is not a simple copy-paste of any other state. The most notable divergence is its breadth. It creates requirements not only for data brokers, but also for data collectors, entities that have a direct relationship with individuals but sell their personal data to data brokers.

Its greatest impact comes from the creation of a tiered — and costly — structure for annual registration fees, requiring the largest data brokers and data collectors to pay a USD1.5 million annual registration fee. Although the minimum fee, payable for selling the personal data of any number of New Jersey consumers, is not the highest in the country, the second tier is higher than any other state, and kicks in at 100,000 consumers. Data brokers and data collectors also face significant fines for failing to register or update their registration information.

Further, the law prohibits the sale of sensitive data both through the data broker provisions and by amending New Jersey's consumer data privacy law. Violations of that prohibition carry a severe USD50,000-per-record fine.

The law takes effect immediately, except for the requirement that the New Jersey Division of Consumer Affairs create a registry, which takes effect 270 days after enactment, on 27 March 2027.

Data brokers and their suppliers