Guide · US state law

NJDPA: New Jersey's law explained without the legalese

The New Jersey Data Privacy Act has been in force since January 15, 2025 and requires the site to honor the GPC since July 2025. In this guide you will understand who must comply, what counts as sensitive data, the fines, the status of the regulations and what changes for a site with AdSense or Ad Manager.

Audit my site for the US Read the guide

✓Based on the Division of Consumer Affairs' frequently asked questions
✓Practical examples for sites with ads
✓Read-only scan, no changes to the site

100,000New Jersey consumers per year: the main threshold of the law

25,000consumers are enough if the business makes money from selling personal data

$10,000maximum fine for a first violation

$20,000maximum fine for a repeat violation

What it is

A privacy law with no exemption for nonprofits

The New Jersey Data Privacy Act, or NJDPA, is New Jersey's general privacy law. It was signed in January 2024 and took effect on January 15, 2025. Covered businesses and the processors that work for them have had to comply since that date.

The model follows Connecticut's, with some stricter points. Financial data and transgender or nonbinary status are sensitive data. Nonprofits and small businesses are not exempt if they pass the thresholds. And the site must honor universal opt-out signals, such as the GPC, since July 15, 2025.

The law tells the Division of Consumer Affairs to create regulations, and a proposal for rules was even presented for public comment. But the duty to comply with the law does not depend on those rules: businesses and processors have had to comply since January 15, 2025. Before following any regulation detail, check on the Division's website what is actually in effect.

For a site with visitors from the United States, New Jersey weighs in because of the size of its audience. The state is populous, so a portal with significant American traffic can pass 100,000 consumers without noticing.

Checklist

What you need to meet

If your site exceeds the NJDPA thresholds, these points need to be working.

1
Respect GPC
Since July 15, 2025, the site must accept universal opt-out signals, such as GPC. Anyone who arrives with the signal on must be treated as someone who opted out of sale and targeted ads.
Example
Visitor with GPC turned on: the site turns on Google's restricted data processing for them only, without asking for another click.
```

<ins class="adsbygoogle" ...
     data-restrict-data-processing="1"></ins>

// GPT (Ad Manager)
googletag.pubads().setPrivacySettings({
  'restrictDataProcessing': true
});
```
Show a clear way to opt out
Anyone who sells data or does targeted advertising must offer a clear way to opt out. The privacy notice must explain how the visitor uses this right.
Example
Google's state regulations message shows the Do Not Sell or Share My Personal Information link.
Full privacy notice
The notice says which data the site processes, for what, who it shares it with, and how the visitor requests access, correction, deletion or appeals.
Example
To request access, correction or deletion of your data, write to privacy@yoursite.com.
Policy with the sentences Google requires
AdSense requires the privacy policy to warn about the ad cookies of Google and other vendors. It must also say how the visitor opts out of personalized ads.
Example
Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to your website or other websites. You can opt out of personalized advertising in Google's Ads Settings.
Consent for sensitive data
Sensitive data can only be processed with consent. In New Jersey, the list includes financial information.
Example
A credit simulator asks first: Can we use your answers to show offers? Yes or No.
Consent from teens
If you know or should know that the visitor is 13 to 16 years old, the Division says their consent is required before processing personal data.
Data protection assessment
When processing sensitive data or doing high-risk activities, record a risk and benefit assessment in writing.

In practice

Right and wrong

WrongThe site ignores GPC and keeps requesting personalized ads for this visitor.
RightThe browser sends GPC and the site treats the signal as an opt-out of sale and targeted ads.
WrongThe site does targeted advertising and offers no way to opt out.
RightThe footer shows the Do Not Sell or Share My Personal Information link and the opt-out changes the ad request.
WrongA simulator passes the visitor's income to ad partners without asking.
RightThe site asks for consent before using financial data the visitor typed in.
WrongThe policy is vague and does not say how to request deletion or how to opt out of sale.
RightThe policy explains data, purposes, third parties and rights, with an easy-to-find link.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for New Jersey, so you can use Google's own message or a CMP with GPP.

Who must comply

The thresholds that bring your site under the NJDPA

The law applies to anyone who does business in New Jersey or offers products and services targeted to residents of the state and, in a calendar year, passes one of the thresholds below.

100,000 consumers

Controls or processes personal data of at least 100,000 New Jersey consumers during the year.

25,000 and data sales

Controls or processes data of at least 25,000 consumers and makes money from selling personal data, in the Division of Consumer Affairs' words.

Nonprofits too

Nonprofits and small businesses are not excluded. If they pass the thresholds, they must comply with the law.

Processors too

Vendors that process data on behalf of a covered business also have duties, such as following instructions and the contract.

Definitions

The words of the law, in plain site-owner language

New Jersey's definitions are similar to Connecticut's, with a broader list of sensitive data.

Personal data

Information that identifies or can identify a specific person. On a site, this includes cookies, device identifiers, IP and newsletter email.

Sensitive data

Racial or ethnic origin, religious belief, health condition, financial information, sex life and sexual orientation, immigration status, transgender or nonbinary status, genetic or biometric data, precise geolocation and children's data.

Sale

The exchange of personal data for money or other valuable consideration with a third party. Transfers to processors are left out.

Targeted advertising

An ad chosen using data about the visitor's activity over time on other companies' sites and apps. An ad based on the context of the page does not count.

People's rights

What a New Jersey resident can ask for

Consumers cannot sue the business under this law, but they can complain to the Division of Consumer Affairs. The business must respond to requests and offer an appeal.

Confirm and access

Find out whether the company processes their data and get access to that data.

Fix

Ask for wrong data to be corrected.

Delete

Ask for personal data to be deleted.

Portability

Receive a copy of the data in a format they can take to another service.

Refuse targeted ads and sale

Ask that the data not be used for targeted advertising and not be sold, including through a universal signal such as the GPC.

Refuse automated profiling

Refuse profiling that leads to decisions with legal or similarly significant effects.

Site obligations

What a covered site must have working

Full privacy noticeThe notice must explain which categories of data are processed, what for, how to exercise rights and appeal, which data goes to third parties and which types of third parties receive that data.
Clear opt-out and GPCAnyone who sells data or does targeted advertising must show a clear path to opt out and, since July 15, 2025, accept universal opt-out signals, such as the GPC.
Consent for sensitive dataSensitive data, including financial information, can only be processed with the visitor's consent.
Protection for teenagersFor consumers aged 13 to 16, the business needs consent before using the data for targeted advertising, sale or profiling. For under-13s, the federal COPPA law applies.
Data protection assessmentBefore high-risk processing, such as sale of data, sensitive data and profiling that could cause unfair treatment or harm, the business must assess risks and benefits in writing.
Contracts with processorsVendors that process data on the business's behalf follow its instructions, under a contract with the rules of processing.

Enforcement and fines

Fines per violation and the end of the cure period

The law is enforced by the New Jersey Attorney General's office and the Division of Consumer Affairs, using the tools of the state consumer fraud law.

$10,000 for the first

The fine can reach $10,000 for the first violation.

$20,000 for later ones

Repeat violations can cost up to $20,000 each. The Attorney General's office can also seek a court order and compensation for victims.

Cure period ended

Until July 1, 2026, the Division notified the business and gave it 30 days to fix violations that could be fixed. That period has ended.

Consumer complaint

Consumers file the complaint on the Division of Consumer Affairs website. They cannot sue the business under this law.

Timeline

NJDPA dates

As of November 2026, the law is in force, the GPC is mandatory, the cure period has ended and the regulations should still be checked on the Division's website.

January 2024
Signing
New Jersey passes the general privacy law.
January 15, 2025
Entry into force
Covered businesses and processors begin complying with the law.
2025
Proposed regulations
The Division of Consumer Affairs presents a proposal for rules for public comment. The law already applies regardless of it.
July 15, 2025
GPC required
A covered site must honor universal opt-out signals, such as the Global Privacy Control.
July 1, 2026
End of the cure period
The period in which the Division gave 30 days to fix problems before acting ends.

Sites with AdSense and Ad Manager

Required GPC and the opt-out path to Google

Since July 15, 2025, a covered site must honor universal opt-out signals. The Division's own frequently asked questions cite the Global Privacy Control, or GPC, as an example. For a visitor who arrives with GPC on, the site must act as if they had clicked the opt-out link.

In AdSense and Ad Manager, under Privacy & messaging, Google offers a US state regulations message, and New Jersey is among the states covered. The message shows the Do Not Sell or Share link. The opt-out turns on restricted data processing, called RDP, and Google stops using past behavior to choose ads.

On the GPC, Google says the partner that implemented the signal can choose to turn on RDP when it receives an opt-out GPC. The setup is up to the site or the CMP, and can be done in the tag, with the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense.

The GPP has a specific New Jersey section, but it is not on the list of sections Google accepts. For Google, the path is the US National section, where refusing sale, sharing or targeted advertising turns on RDP.

In practice

What is and is not allowed in New Jersey

Examples for a site with New Jersey traffic that monetizes with programmatic ads.

Allowed

Show contextual ads to people who opted out or arrived with GPC turned on
Use Google's state regulations message to offer the opt-out link
Take the opt-out to Google through the US National section of the GPP
Apply the GPC to all US traffic, to keep the setup simple
Keep complying with the law even without adopted regulations, based on the statute's text

Not allowed

Ignore the GPC and keep requesting personalized ads for that visitor
Process the visitor's financial information, such as data from a credit simulator, without consent
Use data of teenagers aged 13 to 16 for targeted ads without consent
Assume your nonprofit or association is exempt just because it is not for profit
Count on 30 days to fix things after a notice: that period ended in July 2026

Common errors

Where sites trip up with the NJDPA

These problems show up on sites that set up US privacy looking only at California.

Forgetting financial data

Finance sites collect income or debts in forms and calculators and pass them to partners. In New Jersey, that is sensitive data and requires consent.

GPC only in California

The CMP applies the GPC only for California, and the signal from New Jersey visitors is ignored.

Waiting for the regulations

The business put off the changes while waiting for the final rules. The law has applied since January 2025, with or without regulations.

Opt-out that does not change the ads

The visitor opts out, but ad requests continue without RDP and without an opt-out in the GPP string.

State section alone in the GPP

The CMP sends only the New Jersey section, which Google does not read. Without the US National section, the opt-out does not reach Google.

Policy without third parties

The privacy page does not say which types of third parties, such as ad networks and measurement partners, receive the data.

In ConsentMode

What the audit checks for New Jersey

Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
Turns on the GPC signal in the audit browser and compares the page and the ad requests with and without the signal.
Reads the GPP string and checks that the US National section exists and records the opt-out.
Identifies the CMP or Google's state regulations message from the page code.
Checks that the privacy page includes data categories, purposes, third parties, rights and appeal.

Run an audit See everything that is checked

Frequently asked questions

Are New Jersey's regulations already in effect?

A proposal for rules was presented for public comment, but check the Division of Consumer Affairs website to see whether final rules are in effect before following any detail of them. The law itself has applied since January 15, 2025, with or without regulations.

Do I have to honor the GPC?

Yes, if the law applies to your site. Since July 15, 2025, universal opt-out signals, such as the GPC, must be honored.

My association is a nonprofit. Am I exempt?

No. In New Jersey, nonprofits and small businesses must comply with the law if they pass the thresholds.

Does selling data in small amounts already put me at the 25,000 threshold?

It can. According to the Division of Consumer Affairs, the second threshold applies to anyone who processes data of at least 25,000 consumers and makes money from selling personal data. The Division does not cite a minimum revenue amount, so it is worth confirming your case with a lawyer.

Do I still have time to fix things after a notice?

The 30-day period applied until July 1, 2026. After that, the Division can act without giving that period.

Does ConsentMode make my site compliant?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out, the GPC, the GPP and the privacy page, so you can fix it with your vendor and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether your site honors the GPC in New Jersey

The audit opens the site as a US visitor, with and without GPC, and shows what to fix, without changing anything.

Start the audit