A 5328 — Regulates data brokers, data collectors, and collection and dissemination of certain sensitive information.

2026, c.025 (A53281R)(A5328 §§2,4,3,5,61R) C.56:8-166.20CHAPTER to25 56:8-166.24  §§7,8An NoteAct  concerning P.L.personal data, data brokers, data collectors, and amending P.L.2023, c.266 and supplementing Title 56 of the Revised Statutes.

2026, CHAPTER 25, approved June 30, 2026 Assembly, No.

5328 (First Reprint)     An Act concerning personal data, data brokers, data collectors, and amending P.L.2023, c.266 and supplementing Title 56 of the Revised Statutes.

  C.56:8-166.12  Controller, personal data, responsibilities, security.

     [(7)] (8) not process the personal data of a consumer for purposes of targeted advertising, the sale of the consumer's personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer without the consumer's consent, under circumstances where a controller has actual knowledge, or willfully disregards, that the consumer is at least 13 years of age but younger than 17 years of age;

     [(8)] (9)  specify the express purposes for which personal data are processed;

and      [(9)](10)  (10)not  not conduct processing that presents a heightened risk of harm to a consumer without conducting and documenting a data protection assessment of each of its processing activities that involve personal data acquired on or after the effective date of P.L.2023, c.266 (C.56:8-166.4 et seq.) that present a heightened risk of harm to a consumer.

(cf:  C.56:8-166.20  Definitions;

P.L.2023,data c.266,broker s.9)and  data     collector 2. registration, (Newfees, section)  required a.information.

As     used2.  ina. P.L.     , c.    (C.        ) (pending before the Legislature as this bill):

As used in P.L.2026, c.25 (C.56:8-166.20 et al.):

data that cannot be reasonably used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such an individual, if the data broker or data 1[controller]collector collector1 that possesses the data:  (1) takes reasonable measures to ensure that the data cannot be associated with an individual;

     “Process” or “processing” means an operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data, and also includes the actions of a 1[controller] data broker or data collector1collector directing a processor to process personal data.

          “Processor” “Processor” means a person, private entity, public entity, agency, or other entity that solely processes personal data on behalf of the 1[controller] data broker or data collector1.collector.

     “Publicly available information” means information that is lawfully made available from federal, State, or local government records or widely distributed media or information that a 1[controller] data broker or data collector1collector has a reasonable basis to believe a consumer has lawfully made available to the general public and has not restricted to a specific audience.

     b.    The Division of Consumer Affairs in the Department of Law and Public Safety shall establish and maintain a public registry of data brokers and data collectors engaged in 1[processing] selling or licensing1licensing personal data of New Jersey consumers.  Using the information submitted pursuant to subsection c.

(1)          (1) Each data broker and data collector engaged in selling or licensing personal data of New Jersey consumers shall annually register with the division and pay to the division a registration fee in accordance with paragraph (2) of this subsection.  Registration fees collected pursuant to this subsection shall be used as necessary to effectuate the purposes of this act.

     (2) The registration fee schedule shall be as follows for a data broker that 1[possesses] sells or licenses1,licenses, or a data collector that collects and sells or licenses to a data broker, the personal data of:

     (6)   a history of data breaches and other cybersecurity events affecting the data broker or data collector and personal 1[identifyingdata information] data1 in the data broker’s or data collector’s possession, including the number of individuals affected by each data breach or cybersecurity event;

     (7)   a separate statement detailing the data collection practices, databases, sales activities, and opt-out methods that are applicable to the personal 1[identifyingdata information] data1 of persons under the age of 18 and whether the data broker or data collector has actual knowledge that it possesses the personal 1[identifyingdata information] data1 of persons under the age of 18;

     (8)   any information the division deems appropriate to implement the purposes of P.L.   P.L.2026, ,c.25 c.    (C.56:8-166.20 (C.       et )al.) (pending before the Legislature as this bill) as identified in regulations adopted pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.);

and      (9) the processors who process personal data on behalf of the data broker or data 1[controller]collector. collector1.

of this section shall be considered a data broker or data collector for the purposes of P.L.   P.L.2026, ,c.25 c.    (C.56:8-166.20 (C.       et )al.) (pending before the Legislature as this bill) if the person or entity collects and or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses data to third parties in any way that is not incidental to an activity described in subparagraphs (a) through (d) of paragraph (1) of subsection e.  of this section, unless the person or entity is exempt under paragraph (2) of subsection e.

of this section, unless the person or entity is exempt under paragraph (2) of subsection e.

          g.g.  Nothing in this section shall apply to:

 Nothing     in(1)  thisprotected sectionhealth shallinformation applycollected to:by a covered entity or business associate subject to the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the "Health Insurance Portability and Accountability Act of 1996" (“HIPAA”), Pub.L.104-191, and the "Health Information Technology for Economic and Clinical Health Act," 42 U.S.C.

     (1)  protected health information collected by a covered entity or business associate subject to the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the "Health Insurance Portability and Accountability Act of 1996" (“HIPAA”), Pub.L.104-191, and the "Health Information Technology for Economic and Clinical Health Act," 42 U.S.C.

     (2)(2)   aa financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal "Gramm-Leach-Bliley Act," 15 U.S.C.

     (3)(3)   thethe secondary market institutions identified in 15 U.S.C.

     (4)(4)   anan insurance institution subject to P.L.1985, c.179 (C.17:23A-1 et seq.);

     (5)(5)   thethe sale of a consumer's personal data by the New Jersey Motor Vehicle Commission that is permitted by the federal "Driver’s Privacy Protection Act of 1994," 18 U.S.C.

     (6)(6)   personalpersonal data collected, processed, sold, or disclosed by a consumer reporting agency, as defined in 15 U.S.C.

     (7)(7)   anyany State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, and any division, board, bureau, office, commission, or other instrumentality created by a political subdivision;

       C.56:8-166.22  3.Sensitive data.

 (New     section)3.  a.

 Ina. no case shall a data broker or data collector sell or license sensitive data to any other individual or entity.

     In b.no case shall a data broker or data collector sell or license sensitive data to any other individual or entity.

b.

     (5) the sale of a consumer's 1[personal]sensitive sensitive1 data by the New Jersey Motor Vehicle Commission that is permitted by the federal "Driver’s Privacy Protection Act of 1994," 18 U.S.C.

     (6) 1[personal]sensitive sensitive1 data collected, processed, sold, or disclosed by a consumer reporting agency, as defined in 15 U.S.C.