S 2316 New Jersey Senate · 2026-2027 Regular Session

Regulates data brokers, data collectors, and collection and dissemination of certain sensitive information.**

This bill requires data brokers operating in New Jersey to register with the Division of Consumer Affairs annually ($100 fee) and submit detailed information about their data collection, privacy policies, opt-out options, and data breach history. It directly affects businesses that collect and sell personal identifying information without a direct relationship to the individual, such as those selling health data. The key provision bans data brokers from selling, sharing, or transmitting physical health records (covering treatments for physical conditions) or behavioral health records (covering mental health, substance use, or emotional disorder care). The law establishes a public registry of registered brokers to increase transparency about how sensitive health data is handled.

Issues: ✓ Healthcare ✓ Technology

Bill status in committee 1 of 4 stages cleared

Introduction

Jan 2026

Committee Review

Floor Vote

Governor

Introduced Jan 13, 2026 Last action Jun 30, 2026

Maddy AI version diff · 2 comparisons

What changed between versions

Senate Committee Substitute → Reprint Of Substitute · 12 edits

MAJOR

The bill significantly expands its scope by adding 'data collectors' (businesses that collect consumer data and sell it to data brokers) alongside the existing 'data broker' category, replaces a flat $5,500 registration fee with a tiered schedule reaching up to $1.5 million based on consumer volume, adds a new standalone prohibition on selling sensitive data with broad federal preemption-style exemptions (HIPAA, GLBA, FCRA, insurance, research), and extends the inoperative period for registration requirements from 180 to 270 days.

SCOPE

A new category of regulated entity, 'data collector,' is added. A data collector is a business that collects personal data from consumers with whom it has a direct relationship and sells or licenses that data to a data broker. Data collectors are subject to the same registration, reporting, and penalty requirements as data brokers.

A new section (section 3) creates a standalone prohibition: no data broker or data collector may sell or license sensitive data to any other individual or entity. This carries a $50,000 per-record civil penalty and includes ten specific exemptions covering HIPAA-covered entities, GLBA financial institutions, FCRA consumer reporting agencies, insurance institutions, research data, securities associations, state agencies, and others.

A new general exemption section (subsection g of section 2) exempts from the entire registration regime: HIPAA-protected health information, GLBA-covered financial institutions, secondary market institutions, insurance institutions, NJ Motor Vehicle Commission sales under federal law, FCRA consumer reporting agencies, state agencies and political subdivisions, federally compliant research data, insurance-support organizations, and national securities associations.

A new section 6 clarifies that the act's provisions apply in addition to, and not in lieu of, the existing New Jersey consumer privacy law (P.L.2023, c.266).

Exemptions from data broker status were expanded: title and settlement services regulated by the NJ Department of Banking and Insurance are now exempt, as are nonprofit organizations providing enrollment data reporting for postsecondary institutions. The financial institution exemption was moved from a narrow paragraph to the broader general exemptions section.

DEFINITION

The definition of 'data broker' was narrowed: the activity changed from 'sells, licenses or otherwise provides' to 'sells or licenses.' A processor exclusion was added (disclosure solely for processing on behalf of the broker does not make one a data broker). Government entities are explicitly excluded.

New definitions added for 'data collector,' 'processor' (an entity that solely processes personal data on behalf of a data broker or data collector), and 'sale/sell' (sharing, disclosing, or transferring personal data for monetary or other valuable consideration).

References to 'controller' throughout the bill were replaced with 'data broker or data collector' in the definitions of de-identified data, processing, and publicly available information. The de-identified data definition now also requires the entity to 'enforce or otherwise ensure compliance' with contractual obligations imposed on data recipients.

FISCAL

The flat $5,500 registration fee was replaced with a tiered schedule: $5,000 for 100,000 consumers or fewer; $10,000 for up to 500,000; $100,000 for up to 1 million; $500,000 for up to 1.5 million; $750,000 for up to 2.5 million; $1,000,000 for up to 4.5 million; and $1,500,000 for more than 4.5 million consumers.

REQUIREMENT

Registration requirements now apply to data collectors as well as data brokers. A new registration item requires disclosure of the processors who process personal data on behalf of the registrant. The division is prohibited from publishing data breach history information submitted by registrants.

ENFORCEMENT

Penalties for failure to register now apply to data collectors in addition to data brokers, and the penalty is assessed 'in addition to such registration fees' owed for each year of non-registration. The sensitive data violation penalty (section 5) was narrowed from 'sells, offers for sale, licenses, or otherwise furnishes, provides, or transmits' to 'sells, offers for sale, or licenses.'

TIMELINE

The inoperative period changed from 180 days to 270 days following enactment. It now applies specifically to subsection b. of section 2 (the registration and fee requirements) rather than to the entire former penalties section.

Introduced → Senate Committee Substitute · 10 edits

MAJOR

The Senate Committee Substitute dramatically expands the bill from a narrow data broker registration and health record prohibition into a comprehensive data privacy framework that amends New Jersey's existing Data Privacy Act (P.L.2023, c.266). It adds new controller duties including a blanket ban on selling sensitive data, requires data protection assessments for high-risk processing, raises the registration fee from $100 to $5,500, and increases civil penalties by up to 50x (from $1,000 per health record to $50,000 per sensitive data record). The scope of protected information expands far beyond health records to include financial data, geolocation, religious beliefs, sexual orientation, immigration status, and other categories.

Scope change

The bill expands from a standalone data broker registration act with a narrow health record prohibition into a comprehensive amendment to the state's Data Privacy Act that imposes broad controller duties, defines and protects a wide category of 'sensitive data,' and significantly strengthens enforcement penalties. It also adds Senator Raj Mukherji as co-sponsor and is now styled as a combined substitute for S2316 and S4109.

SCOPE

The bill now amends P.L.2023, c.266 (the New Jersey Data Privacy Act) in addition to supplementing Title 56, adding a new section 9 that imposes duties on all 'controllers' of personal data, not just data brokers.

The prohibition on selling data expands from only 'physical health records' and 'behavioral health records' to all 'sensitive data,' which is a much broader category. The ban applies to all individuals or legal entities regardless of the number of consumers whose data they control.

The registry requirement changes from covering data brokers 'doing business in this State' to those 'engaged in processing personal data of New Jersey consumers,' potentially capturing out-of-state entities that process NJ residents' data.

REQUIREMENT

New controller duties added: limit collection to what is adequate and necessary; do not process for incompatible purposes without consent; implement data security practices; obtain consent before processing sensitive data; comply with anti-discrimination laws; provide a consent revocation mechanism (cease processing within 15 days); obtain consent for targeted advertising, sale, or profiling of individuals aged 13-17; and conduct documented data protection assessments for heightened-risk processing.

Data brokers must now disclose how individuals may confirm deletion of their personal data, in addition to existing opt-out disclosure requirements.

DEFINITION

New definition of 'sensitive data' covering racial/ethnic origin, religious beliefs, mental or physical health conditions, financial account information, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric data, personal data from known children, and precise geolocation data (within 1,750 feet).

The term 'personal identifying information' is replaced with 'personal data,' defined more broadly as any information linked or reasonably linkable to an identified or identifiable person. The data broker definition now includes controllers and adds 'purchases' alongside 'collects.'

FISCAL

Annual data broker registration fee increased from $100 to $5,500 (or such other amount as the director may establish by regulation).

ENFORCEMENT

Civil penalties substantially increased: failure to register or pay fees raised from $50 per day to $2,500 per day; failure to submit or update information raised from $50 per day to $2,500 per day; violation of the sensitive data sale prohibition raised from $1,000 per health record to $50,000 per record.

ELIGIBILITY

The financial institution exemption is narrowed: instead of simply being subject to GLBA Title V, a financial institution must now (a) be directly engaged in financial activities under the Bank Holding Company Act, (b) be regulated by the NJ Department of Banking and Insurance or a federal bank regulator, and (c) have established a personal data compliance program.

Floor votes

How they voted

No floor votes recorded yet.

Full legislative history

Actions timeline

Total actions

Key actions

Committee

May 18, 2026

Committee

Referred to Senate Budget and Appropriations Committee

upper

Jan 13, 2026

Introduced

Introduced in the Senate, Referred to Senate Commerce Committee

upper

2 primary · 1 co-sponsor