SENATE COMMERCE COMMITTEE

STATEMENT TO

SENATE COMMITTEE SUBSTITUTE FOR

SENATE, Nos. 2316 and 4109

STATE OF NEW JERSEY

DATED:  MAY 18, 2026

      The Senate Commerce Committee reports favorably Senate Committee Substitute for Senate Bill Nos. 2316 and 4109.

      This substitute prohibits a controller of a commercial Internet website or online services from selling sensitive data, which prohibition will apply to all individuals or legal entities regardless of the number of consumers whose data the individual or entity controls or processes. 

      The bill requires data brokers to register with the Division of Consumer Affairs (division) in the Department of Law and Public Safety and prohibits the brokering of physical or behavioral health records.

      Under the bill, a data broker means a person or entity that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells, licenses or otherwise provides such data to third parties.

      Specifically, the bill requires the division to establish and maintain a public registry of data brokers doing business in New Jersey.  Data brokers are required to register with the division, pay an annual registration fee of $5,500 or other amount established by the Director of Consumer Affairs by regulation, and provide the division with certain information about the data broker’s business as described in the bill.  Collected registration fees will be used to implement the provisions of the bill.

      Under the bill, the information that data brokers are required to submit to the division at the time of registration includes:  

      (1)  the data broker’s name and primary physical, email, and Internet addresses;

      (2)  whether the data broker permits individuals to opt out of the data broker’s collection practices and direct the data broker to delete any personal data in the broker’s possession, including the method for requesting an opt-out, the type of opt-out, whether the opt-out is limited to certain activities or sales, whether the data broker permits individuals to authorize a third party to opt out on the individual’s behalf, and the manner in which individuals may confirm the deletion of personal data by the data broker;

      (3)  a statement specifying the data collection, databases, or sales activities from which an individual may not opt out;

      (4)  whether the data broker uses a credentialing process for purchasers of data and, if applicable, a general explanation of that process;

      (5)  a history of data breaches and other cybersecurity events affecting the data broker and personal identifying information in the data broker’s possession, including the number of individuals affected by each such data breach or cybersecurity event;

      (6)  a separate statement detailing the data collection practices, databases, sales activities, and opt-out methods that are applicable to the personal identifying information of persons under the age of 18 and whether the data broker has actual knowledge that it possesses the personal identifying information of persons under the age of 18; and

      (7)  any information the division deems appropriate to implement the purposes of the bill.

      Using the information submitted by data brokers, the division is to include in the registry, at minimum, each data broker’s name and physical address, a general email address that may be used to request information about the data broker’s privacy policies and data collection practices, a general Internet website address for the data broker, an Internet website address specific to the data broker’s privacy policies, and any relevant opt-out information.  The division is required to review and update this information at least annually.

      Data brokers that fail to submit and update information as required under the bill, or that fail to register and pay the registration fee required under the bill, will be liable for a civil penalty of $2,500 for each day the data broker is not in compliance.

      A person or legal entity that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells, licenses or otherwise provides that data to third parties is not considered a data broker for the purposes of the bill if: 

      (1)  the full extent to which the person or entity collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells, licenses or otherwise provides such data to third parties is incidental to conducting one or more of the following activities:

      (a)  developing or maintaining a third-party e-commerce or application platform;

      (b)  providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier;

      (c)  providing publicly available information related to an individual’s business or profession; or

      (d) providing publicly available information via real-time or near real-time alert services for health or safety purposes; or

      (2)  the person or entity is a financial institution or an affiliate of a financial institution that:

      (a) is only and directly engaged in financial activities as described the federal Bank Holding Company Act;

      (b) is regulated and examined by the State Department of Banking and Insurance or an applicable federal bank regulatory agency; and

      (c) has established a program to comply with all applicable requirements of the New Jersey Department of Banking and Insurance or the applicable federal bank regulatory agency concerning personal data.

      A person or entity that engages in these activities will still be considered a data broker for the purposes of the bill if the person or entity collects and sells or licenses personal identifying information in any way that is not incidental to one or more of those activities.

      A data broker, including a controller, that sells, offers for sale, licenses, or otherwise furnishes, provides, or transmits to any other individual or sensitive data in violation of P.L.2023, c.266  or the bill’s provisions will be liable to a civil penalty of $50,000 for each record sold, offered for sale, licensed, or otherwise furnished, provided, or transmitted.