Key Facts
Overview
The NJDPA features the shortest opt-out processing requirement among US states (15 days) and explicitly requires that universal opt-out mechanisms must NOT default to opt-in. Coverage extends to profiling with legal or similarly significant effects, broader than most state laws.
What This Means for Your Website
- GPC/UOOM signals must be honored from July 2025, and must NOT default to opt-in
- Opt-out requests must be processed within 15 days (shortest among US states)
- Opt-in consent required for sensitive data
- Escalating penalties: $10,000 for first violations, $20,000 for subsequent
- The cure period (30 days) sunsets July 15, 2026
Key Requirements
The NJ AG and Office of Consumer Affairs enforce the NJDPA with escalating penalties. Consumer requests must be fulfilled within 45 days. The explicit prohibition on UOOM defaulting to opt-in is unique. Coverage of profiling with legal effects broadens the law's scope beyond most states.
How ConsentStack Handles This
ConsentStack processes New Jersey opt-out requests within the 15-day window and ensures UOOM mechanisms never default to opt-in, meeting the NJDPA's distinctive requirements.
Penalties
$10,000 per first violation; $20,000 per subsequent violation.
Key Requirements
- Honor GPC/UOOM signals from July 2025, and they must NOT default to opt-in
- 15-day opt-out processing requirement, shortest among US states
- Opt-in consent for sensitive data
- Consumer rights: access, correct, delete, portability, opt-out
- UOOM covers profiling with legal/significant effects
Notable Provisions
- 15-day opt-out processing, shortest among US states
- UOOM must NOT default to opt-in, an explicit requirement
- Escalating penalties ($10K first / $20K subsequent)
- Cure period sunsets July 2026
Data Subject Rights
Confirm whether a controller processes your personal data and access that data, though the controller need not provide it in a manner that would reveal its trade secrets.
Correct inaccuracies in your personal data, taking into account the nature of the information and the purposes of the processing.
Have a controller delete personal data concerning you; for data it obtained from another source, it may instead keep a minimal record of your request so the data stays deleted.
Obtain a copy of your personal data held by the controller in a portable and, to the extent technically feasible, readily usable format that lets you transmit it to another entity, though the controller need not provide it in a manner that would reveal its trade secrets.
Opt out of the processing of your personal data for targeted advertising, including through a user-selected universal opt-out mechanism such as a browser setting.
Opt out of the sale of your personal data, including through a user-selected universal opt-out mechanism such as a browser setting.
Opt out of profiling in furtherance of decisions with legal or similarly significant effects, which the law limits to decisions providing or denying financial or lending services, housing, insurance, education, criminal justice, employment, health care or access to essential goods and services.
Designate another person, including through a website link, browser setting or extension, or global device setting, to opt out on your behalf; this agent right covers opt-outs only.
Appeal a controller's refusal to act on your request, within a reasonable period after you receive the decision, through a process that must be conspicuously available and similar to the process for submitting requests.
If your appeal is denied, the controller must give you an online mechanism, if available, or other method to contact the New Jersey Division of Consumer Affairs and submit a complaint.
Revoke consent you gave, for example to the processing of sensitive data, through a mechanism at least as easy as the one you used to give it, after which the controller must stop processing that data.
A controller may not discriminate against you for opting out of sale, targeted advertising or profiling, or raise a product's price or reduce its availability solely because you exercised a right and for reasons unrelated to feasibility or the service's value; disclosed discounts and loyalty programs stay allowed.
US State Specifics
Other North America Regulations
Frequently Asked Questions
NJDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with NJDPA
ConsentStack helps you implement Opt-out consent for New Jersey, United States automatically.