New Jersey enacted the most expensive data broker registration regime in the country on June 30, 2026, then quietly hit pause on enforcing the part that costs the most. On July 10, 2026, the New Jersey Attorney General's Division of Consumer Affairs (DCA) posted an alert on its website stating that covered data brokers and data collectors will not have to register, or pay any registration fee, until the agency's public registry launches in spring 2027.
The underlying law, A5328, is now P.L.2026, c.25. It passed the Legislature and was signed within days, and most of its substance, including a ban on selling or licensing certain "sensitive data," took effect immediately. The registration and fee piece is what got the delay, and it is also the piece that made headlines: annual fees for covered sellers range from $5,000 up to $1.5 million a year, well above the $6,000 flat fee California charges under its own data broker law.
That gap between "the law is in effect" and "the fee is being collected" is the detail worth understanding if your business touches New Jersey resident data at any scale. The prohibition on selling sensitive data did not move. The registry and its fees did.
Source: New Jersey Division of Consumer Affairs, Office of Consumer Protection Alerts, captured August 4, 2026.
What the delay actually covers, and what it does not
The DCA's alert is narrow and specific. It says the registry will launch in spring 2027, that the first registration period will run from April 1, 2027 through June 30, 2027, and that "until then, covered data brokers and data collectors will not be required to register under the law or to pay any registration fees." It also notes the Division will issue further guidance on the law's requirements, including how it plans to enforce the sensitive-data sale prohibition, in the coming months.
Figure: The top annual registration fee under New Jersey's data broker law, the fee tier now on hold until the 2027 registration window.
Nowhere in the alert does the DCA say the sensitive-data sale ban is delayed. That prohibition, which bars data brokers and data collectors from selling or licensing sensitive data as the law defines it, took effect the moment the governor signed the bill. A business that stops worrying about New Jersey because "the data broker law got pushed back" is reading the delay too broadly. Only the registry and its fees moved. The conduct restriction did not.
Why the fee structure drew this much pushback
New Jersey's registration fees scale steeply with how many state residents' records a business sells or licenses in a year, and the top tiers are what separates this law from every other state's data broker registry.
| Consumer records sold per year | Annual registration fee |
|---|---|
| Up to 100,000 | $5,000 |
| 100,001 to 499,999 | $10,000 |
| 500,001 to 999,999 | $100,000 |
| 1,000,001 to 1,499,999 | $500,000 |
| 1,500,001 to 2,499,999 | $750,000 |
| 2,500,001 to 4,499,999 | $1,000,000 |
| 4,500,000 and above | $1,500,000 |
Compare that to California's data broker registry, which charges every registrant a flat $6,000 regardless of scale, and it becomes clear why law firms tracking the bill called it the costliest data broker registration regime enacted by any state so far. A mid-size data broker selling records on a couple million New Jersey residents could owe $750,000 a year just to stay registered, on top of whatever it already pays California, Texas, Oregon, Vermont, and the other states running their own data broker registries.
What this means if you use a privacy policy generator
If your business sells or licenses personal data at any real volume, and New Jersey residents are anywhere in that dataset, this is a compliance calendar item, not a delete-and-forget notice. The registration and fee obligation is coming back in spring 2027, on a defined timeline, and the DCA has already said it will publish more guidance before the April 2027 window opens. Businesses that qualify as "data brokers" or "data collectors" under the law's definitions should be tracking that guidance now rather than waiting for a April 2027 deadline to catch them by surprise.
In the meantime, the sensitive-data sale restriction is live today. If your privacy policy describes selling or sharing data with third parties, and any of that data could fall under New Jersey's definition of sensitive data (which follows the broader pattern set by other state privacy laws: health information, precise geolocation, biometric data, and similar categories), your disclosures need to reflect that a sale-of-sensitive-data restriction already applies in New Jersey, independent of the registry timeline.
Bottom Line
New Jersey's data broker registry and its steep, volume-scaled fees are delayed until the 2027 registration window, but the law's ban on selling sensitive data took effect immediately and has not moved. A privacy policy that lumps all state data broker obligations together, or that only tracks California's flat $6,000 fee as the reference point, will not capture what New Jersey actually requires. Our Privacy Policy Generator keeps state-specific data broker and data-sale disclosures current as laws like this one phase in on their own schedule, so your policy reflects what is actually enforceable today, not just what was true when you last updated it.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
