NJ Proposes Data Privacy Rules Allowing Consumers to Control Personal Information

The proposed rules under the New Jersey Data Privacy Act would give residents expanded rights to access, correct, delete, and limit the use of their personal data.

The Murphy Administration has proposed a set of comprehensive rules aimed at strengthening data privacy protections for New Jersey residents, marking a significant step in the implementation of the New Jersey Data Privacy Act (NJDPA), signed into law in January 2024. The rules, which appeared in the New Jersey Register on June 3, would establish enforceable standards for how businesses collect, use, and share personal data.

“We live in a rapidly changing digital age, and personal data is collected at an alarming rate. Consumers in New Jersey deserve to know exactly when and how their information is used,” said Governor Phil Murphy. “Our residents rely on the internet for everything from shopping and working to deeply personal tasks such as managing finances or medical care. This highly sensitive information should never be exploited. These proposed rules will help ensure consumers in New Jersey can reclaim control over their personal data.”

The proposed regulatory framework is designed to empower consumers with new rights over their personal information—defined broadly under the NJDPA as data that can be linked or reasonably linked to an identified or identifiable individual. Exceptions apply for “de-identified data” or information that is publicly available.

Key provisions of the proposed rules include:

• Opt-Out Rights: Consumers would have the right to refuse the sale of their personal data or its use in targeted advertising or profiling decisions, such as those related to employment, lending, or insurance eligibility. (N.J.A.C. 13:45L-3.4)

• Data Access and Portability: Individuals may request confirmation of whether their data is being processed, obtain a copy of that data, and receive it in a portable format. (N.J.A.C. 13:45L-3.5, 3.8)

• Correction and Deletion: The rules would allow consumers to correct inaccuracies and request the deletion of their personal data. (N.J.A.C. 13:45L-3.6, 3.7)

• Universal Opt-Out Tools: Controllers would be required to honor universal opt-out mechanisms, which allow individuals to communicate their opt-out choices across multiple businesses using a single technology. (N.J.A.C. 13:45L-5.1, 5.2)

• Data Minimization and Purpose Specification: Businesses would need to document and limit their data collection to only what is necessary for the clearly defined purposes for which the data is processed. (N.J.A.C. 13:45L-6.3)

• Consent Requirements: Valid, prior consent would be mandatory before processing sensitive personal data, and before targeting individuals aged 13–17 for advertising or selling their data. (N.J.A.C. 13:45L-7.1)

• Protections for Children: Enhanced safeguards are included for individuals under 13 years of age to prevent exploitation or harm from data misuse. (N.J.A.C. 13:45L-7.4)

The rules aim to bring New Jersey’s privacy protections in line with some of the most robust data privacy laws in the United States, giving residents greater control over when, how, and by whom their personal information is used.

“As data breaches and cyber threats continue to grow in this age of digital consumerism, protecting the personal data of New Jersey residents from unauthorized access and use is more important than ever,” said Attorney General Platkin. “The proposed rules advance consumer privacy protections by requiring internet websites, online providers, and other entities to fully disclose to consumers how their private data will be used, notify consumers of their data privacy rights, and provide them with information on how to exercise those rights.”

“There is a growing sense of helplessness among consumers who do not want their data collected but feel powerless to stop it,” said Elizabeth M. Harris, Acting Director of the Division of Consumer Affairs. “The rules we are proposing today empower consumers to reclaim control over their personal data, including how and when it is collected, shared, or sold.”

A 60-day public comment period on the proposed rules is now open and will continue through August 1, 2025. During this time, members of the public and industry stakeholders are encouraged to submit written comments for consideration.

Following the conclusion of the comment period, the Division of Consumer Affairs will review all submissions and publish a Notice of Adoption that will include a summary of comments and official responses. The rules will become final upon publication of that notice, anticipated sometime in 2026.

The NJDPA represents an evolving legal landscape aimed at increasing transparency and accountability in data handling practices among commercial entities operating in New Jersey.