New Jersey Data Privacy Act (Profiling Provisions)
Effective date
Penalty
Up to $10,000 per first violation, $20,000 per subsequent. Thirty-day cure period sunsets July 15, 2026 (30 months after enactment). Enforced by New Jersey AG.
Cure period
30 days (through July 15, 2026)
Obligations mapped
8 obligations
Overview
Uniquely covers nonprofits with no revenue threshold. Universal opt-out mechanism (UOOM) requirement effective July 15, 2025 (18 months after enactment), extended to profiling decisions, unique among state privacy laws. Proposed rules would require controller consent before using personal data to train AI models.
This is a privacy law with automated decision-making provisions.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Deployers and users of covered AI systems and tools
- Organizations operating in New Jersey
This regulation applies to companies that use or deploy AI tools and systems built by other vendors. If your company uses AI-powered products in the areas listed below, this regulation may apply to you.
S332
AI categories covered
- Consumer-facing AI
- Automated decision-making
- Algorithmic profiling
Specific AI use cases:
- Customer profiling and segmentation
What this requires you to do
8 obligations identified from statutory analysis.
Section 9.a.(7)
Section 7.a.(5)(c)
Section 9.a.(9), 9.b, 9.c.(1), 9.d
Section 8.a
Section 5
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
Up to $10,000 per first violation, $20,000 per subsequent. Thirty-day cure period sunsets July 15, 2026 (30 months after enactment). Enforced by New Jersey AG.
Cure period: 30 days (through July 15, 2026).
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Legislative history
cure period expired
30-day cure period sunsets (30 months after enactment)
rulemaking
AG proposes rules including consent for AI training data use
effective
UOOM requirement takes effect (18 months after enactment)
effective
Takes effect (365 days after enactment)
Related regulations
New Jersey AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.