New Jersey passes consumer privacy law

New Jersey woke up this morning and got itself a privacy law.

The Garden State became the first state to pass comprehensive privacy legislation in 2024 after Gov. Phil Murphy signed Senate Bill 332 into law this week.

The law, which goes into effect next January, effectively gives New Jersey residents the ability to opt out of allowing companies to sell their “personally identifiable information.”

“Far too often consumer privacy is exploited without consumers knowing that their data is being shared and sold. This important legislation will help consumers reclaim control over their own personal data, and allow them the choice to share information that is personal to them,” Murphy, a Democrat, said in a press release.

Leave the data, take the cannoli: The bill covers any company doing business in New Jersey that controls or processes the personal data of at least “100,000 consumers,” or any business that processes the data of at least 25,000 consumers and makes money from it. Like California’s consumer privacy law, a “sale” is defined as “sharing, disclosing, or transferring” data for money or “other valuable consideration,” which could apply to third parties like ad-tech vendors.

There are some carve-outs, including “personal data processed solely for the purpose of completing a payment transaction.”

The law doesn’t include a private right of action, meaning enforcement will have to come from New Jersey’s Attorney General; residents won’t be able to sue companies over privacy infractions.

So what, no $%%# data now? Since California passed the California Consumer Privacy Act in 2018, 12 other states have signed their own comprehensive consumer privacy bills into law, including Texas, Delaware, Virginia, and Tennessee, according to Bloomberg Law.

New Hampshire is mostly likely next. This week, the state’s legislature passed its own privacy bill, which is now awaiting the governor’s signature.