Prohibits controller of commercial Internet website or online service from selling sensitive personal data.

This bill prohibits controllers of commercial websites and online services in New Jersey from selling sensitive personal data, such as financial information, health records, and biometric data. It applies to all individuals and legal entities regardless of the size of their consumer base and requires explicit consent before processing sensitive information. The law also mandates that companies implement strong data security practices and provides consumers with a clear mechanism to revoke consent within 15 days. Additionally, it requires data protection assessments for activities that pose a heightened risk of harm, including targeted advertising and data sales.