SENATE BUDGET AND APPROPRIATIONS COMMITTEE

STATEMENT TO

SENATE COMMITTEE SUBSTITUTE FOR

SENATE, Nos. 2316 and 4109

with committee amendments

STATE OF NEW JERSEY

DATED:  JUNE 28, 2026

      The Senate Budget and Appropriations Committee reports favorably and with committee amendments a Senate Committee Substitute for Senate Bill Nos. 2316 and 4109.

      As amended by the committee, the substitute bill prohibits a controller of a commercial Internet website or online services from selling sensitive data, which prohibition will apply to all individuals or legal entities regardless of the number of consumers whose data the individual or entity controls or processes.

     Under the bill, the Division of Consumer Affairs in the Department of Law and Public Safety (division) is to establish and maintain a public registry of “data brokers” and “data collectors,” as these terms are defined in the bill, engaged in processing personal data of New Jersey consumers.   The registry is to include, at a minimum, for each data broker and data collector: the data broker’s or data collector’s name and physical address; a general email address that may be used to request information about the data broker’s or data collector’s privacy policies and data collection practices; a general Internet website address for the data broker or data collector; an Internet website address specific to the data broker’s or data collector’s privacy policies; and any relevant opt-out information. 

     Each data broker and data collector engaged in processing personal data of New Jersey consumers is to annually register with the division and pay to the division a registration fee according to the schedule provided in the bill.

      Under the bill, each data broker and data collector is to submit the following information to the division at the time of registration, which information is to be updated by the data broker or data collector at least annually, or at such other frequency as the division may require: (1) the data broker’s or data collector’s name and primary physical, email, and Internet website addresses; (2) whether the data broker or data collector permits individuals to opt out of the data broker’s or data collector’s collection practices, including the method for requesting an opt-out, the type of opt-out, whether the opt-out is limited to certain activities or sales, and whether the data broker or data collector permits individuals to authorize a third party to opt out on the individual’s behalf; (3) whether the data broker or data collector permits individuals to direct the data broker or data collector to delete any personal data in the data broker’s or data collector’s possession; (4) a statement specifying the data collection, databases, or sales activities from which an individual may not opt out; (5) whether the data broker or data collector uses a credentialing process for purchasers of data and, if applicable, a general explanation of that process; (6) a history of data breaches and other cybersecurity events affecting the data broker or data collector and personal identifying information in the data broker’s or data collector’s possession, including the number of individuals affected by each data breach or cybersecurity event; (7) a separate statement detailing the data collection practices, databases, sales activities, and opt-out methods that are applicable to the personal identifying information of persons under the age of 18 and whether the data broker or data collector has actual knowledge that it possesses the personal identifying information of persons under the age of 18; (8) any information the division deems appropriate to implement the purposes of the bill; and (9) the processors who process personal data on behalf of the data broker or data controller.

     Finally, the bill imposes civil penalties for violations of the bill’s provisions.

COMMITTEE AMENDMENTS:

      The committee amendments:

      1) define and add the term “data collector” to the bill’s provisions;

      2) revise the definitions of “data broker” and “de-identified data”;

      3) define “processor” and “sale”;

      4) add a registration fee schedule;

      5) revise information submitted to the division at the time of registration;

      6) revise the penalty provisions in sections 4 and 5;

      7) convert subsection e. of section 2 into a new and expanded section 3 that establishes certain exclusions;

      8) restrict provisions of the bill to the sale or licensing of data;

      9) stipulate that a person engaged in certain financial or real estate services or title and settlement services that are regulated by the Department of Banking and Insurance, as provided in the bill, is not to be considered a data broker or data collector;

      10) stipulate that certain national securities associations and certain nonprofit organizations are not to be considered data brokers or data collectors;

      11) provide that the division is not to publish any information that is submitted to it pursuant to paragraph (6) of subsection d. of section 2;

      12) specify that the exemption list in subsection e. of section 2 is only an exemption from the provisions of section 2, and not an exemption from the entirety of the bill;

      13) create a new exemption list in subsection g. of section 2;

      14) insert a new section 6 that pertains to the application and interpretation of the bill’s provisions; and

      15) revise citation, as well as the effective date, numbering, punctuation, synopsis, usage, and title.

FISCAL IMPACT:

      Fiscal information for this bill is currently unavailable.