How New Jersey's New Data Broker Law A5328 Affects Marketing

Introduction

A5328 is New Jersey’s dedicated data broker law, signed into law as P.L. 2026, c. 25. New Jersey’s data broker law took effect on June 30, 2026, and it is designed to regulate how data brokers and data collectors sell or license personal data of state residents. The statute complements, rather than replaces, the broader New Jersey Data Protection Act (S332 / NJDPA), which has been effective since January 15, 2025.

The new law targets entities that compile, sell, or license personal data of New Jersey residents, including many firms that would never call themselves “traditional” brokers. It introduces a formal data broker registration regime with the Division of Consumer Affairs and links non-compliance to material daily penalties. For marketers, this law directly touches third-party data used for audience targeting, data enrichment, lead scoring, and cross-device profiling.

Pandectes GDPR ComplianceThe most popular & reviewed GDPR app for Shopify★★★★★ 5/5 · 3,000+ reviews · Built for ShopifyInstall free on Shopify

Who Counts as a Data Broker or Data Collector Under A5328?

Marketing and ecommerce teams must determine whether they qualify as a “data broker” or a “data collector” under New Jersey law, even if they have never used those labels internally.

A data broker under A5328 is an entity that sells or licenses personal data it did not collect directly from the consumer. Think list vendors, ad tech companies, identity resolution providers, and firms that aggregate brokered personal information from multiple sources.

The law also creates a category for “data collectors” that must comply with similar regulations as data brokers. The law defines “data collectors” as entities with a direct consumer relationship that then sell or license their customers’ personal data for marketing or other downstream uses. This is a distinctive feature of New Jersey’s broker law. In most states, only entities without direct relationships are regulated. New Jersey also pulls in first-party businesses.

Concrete marketing-relevant examples:

• A retailer that sells hashed email audiences to an ad network
• A fintech app that licenses behavioral data to a third party
• A publisher that monetizes reader profiles through data co-ops

Some sectors may be exempt. Financial institutions covered by the Gramm-Leach-Bliley Act, HIPAA-covered entities, and consumer reporting agencies regulated under the Fair Credit Reporting Act have partial or full exemptions at the entity or data level. But non-bank lenders, fintechs, and many DTC brands likely are not exempt.

The bottom line: assess your role based on actual data practices and commercial terms, not just on job titles like “marketing partner” or “analytics provider.”

Registration Requirements and Deadlines for Data Brokers and Data Collectors

A5328 introduces mandatory annual data broker registration and public disclosures for any covered entity selling or licensing personal data of New Jersey residents. Covered entities must disclose detailed information about their data practices during registration, including their legal name, contact information, types of personal data handled, opt-out methods, deletion policies, and whether they collect minors’ data.

Data collectors must register annually starting March 27, 2027, with the first registration window expected from April 1 through June 30, 2027. The law imposes steep tiered fees based on consumer data volume handled:

NJ Consumers Whose Data Is Sold/Licensed	Annual Fee
≤ 100,000	$5,000
100,001 – 500,000	$10,000
500,001 – 1,000,000	$100,000
1,000,001 – 1,500,000	$500,000
1,500,001 – 2,500,000	$750,000
2,500,001 – 4,500,000	$1,000,000
> 4,500,000	$1,500,000

Registration fees range from $5,000 to $1.5 million annually, which could influence how aggressively firms expand data-driven marketing in the state. Failing to register incurs a $ 2,500-per-day penalty, and these penalties compound with the obligation to repay fees for prior missed years.

To prepare, marketers should:

• Build and maintain an inventory of personal data sources
• Categorize outbound data uses (ads, lookalike audiences, enrichment)
• Coordinate with legal and privacy teams on registration strategy

Pandectes customers can leverage their privacy dashboards, consent logs, and scanning reports to support accurate registration and record-keeping.

The Ban on Selling Sensitive Data and Its Impact on Marketing

New Jersey’s data broker law does more than require registration. It outright prohibits selling sensitive data without consumer consent, dramatically tightening the rules for some high-value marketing datasets.

Sensitive data under New Jersey’s privacy law includes:

• Health information (mental or physical conditions, treatments)
• Precise geolocation data (within a radius of approximately 1,750 feet)
• Financial account data, including login credentials and financial information
• Biometric data such as facial templates and fingerprints
• Sexual orientation or gender identity
• Racial or ethnic origin
• Data collected from a known child
• Citizenship or immigration status

Violations of the sensitive data prohibition can incur penalties of $50,000 per record sold, licensed, or offered for sale. A marketing list containing just 10,000 individuals with sensitive attributes could generate $500 million in liability.

Marketing-centric examples of sensitive data use that are now highly constrained:

• Hyper-local geofencing around medical clinics
• Audiences built on health conditions or financial distress indicators
• Biometric-based personalization from in-store cameras

Even “hashed” or “pseudonymous” identifiers may still count as personal data if they can reasonably be linked back to individuals and are associated with sensitive traits. Marketers should design campaigns around non-sensitive segments-contextual targeting, interest-based cohorts, first-party behavioral data with clear consent-and document any consent mechanisms used for edge-case sensitive data scenarios.

How A5328 Interacts With the New Jersey Data Protection Act (S332)

New Jersey now has both a comprehensive privacy law (S332 / NJDPA) and a specific data broker law (A5328). Marketing programs must comply with the combined legal requirements.

The NJDPA applies to controllers processing personal data of at least 100,000 New Jersey residents or 25,000 residents where data sales generate revenue. Its key marketing-related rights include opt-out of targeted advertising and sale of personal data, expanded deletion rights, and enhanced protections for adolescents aged 13–16.

A5328 builds on this framework by bringing data brokers and data collectors into a registration system and banning certain sensitive data sales, even when they meet general privacy law obligations. Together, S332 and A5328 push New Jersey closer to EU-style expectations for transparency, data minimization, and purpose limitation in digital marketing.

For Shopify merchants and ecommerce brands using Pandectes, much of the NJDPA compliance groundwork-consent banners, opt-out links, data subject request tooling-overlaps significantly with what is needed to satisfy the broker law.

Marketing Use Cases Most Exposed by the New Jersey Data Broker Law

Several common marketing activities may now trigger data broker registration, sensitive data restrictions, or higher compliance obligations in New Jersey. Here are the use cases most at risk:

• Third-party audience buying: Purchasing demographic or interest segments from registered data brokers for ad platforms, especially segments that may include sensitive attributes.
• List rental, lead buying, and co-registration: Programs that ingest brokered personal information from vendors with whom the consumer has no direct relationship.
• Data onboarding and identity resolution: Matching offline CRM files to online identifiers through services that aggregate data from multiple sources.
• Data enrichment: Vendors providing appended attributes like income indicators, household composition, or inferred interests that may cross into sensitive territory.

Agencies and marketing service providers acting on behalf of brands may independently meet data broker thresholds when they aggregate and resell such data across clients. Any New Jersey resident in the dataset-not just “New Jersey customers”-can bring an activity under A5328.

Major retailers, publishers, and nearly half of the ad tech ecosystem should segment use cases by risk level (sensitive vs non-sensitive data, direct vs indirect collection, sale vs internal use) and work through these categories with legal counsel. Cross-border ecommerce merchants using Shopify should treat New Jersey residents similarly to EU residents under GDPR from a process standpoint: robust notices, explicit consent where appropriate, and easy opt-outs.

Operational Changes Marketers Should Make Now

Waiting until 2027 to react is risky. Organizations must audit their data-sharing practices to comply with the law, and the sensitive data sale ban is already in effect as of June 30, 2026.

Start with a complete map of personal data flows relevant to marketing: what data is collected, from which channels (website, apps, offline), where it goes (ad platforms, analytics tools, affiliates), and whether any flows qualify as “sale” or “licensing.” Data mapping best practices used for GDPR or CCPA compliance can serve as a foundation.

Classify your partners carefully:

• Pure processors: Email service providers, hosting companies (handle data on your behalf only)
• Data brokers: Vendors that resell or license data they collected from other types of sources
• Data collectors: Your own brand, if you monetize customer data downstream
• Hybrid roles: Partners whose contracts blur the lines

Revise commercial terms with vendors and clients to clarify whether data transfers are “sales,” to allocate responsibility for New Jersey data broker registration, and to restrict unauthorized downstream uses. Update privacy notices and consent flows to reflect New Jersey rights and data broker disclosures, including clear explanations of whether consumer personal data may be sold or shared with brokers.

Compliance obligations require tracking consumer data sources and sharing arrangements. Tools like Pandectes can help Shopify merchants automate parts of this work: automatic cookie scanning, consent banners adapted to US state privacy laws, granular consent logs, and region-aware scripts that adjust tracking behavior for New Jersey visitors.

Consent, Opt-Outs, and Preference Management Under New Jersey Law

The combination of S332 and A5328 makes robust consent and opt-out management central to lawful marketing in New Jersey, especially where targeted advertising and potential “sales” of personal data are involved.

Explicit consent is required for processing or transferring sensitive data and for processing personal data of adolescents aged 13–16 for targeted advertising, sale, or profiling with legal or similarly significant effects. Consumers also have the right to opt out of targeted advertising and sale of personal data under the NJDPA. These rights interact with data broker obligations by limiting what data can lawfully be sold or licensed, even after registration.

Universal opt-out mechanisms and authorized agents are recognized under S332. Marketers should prepare to respect browser- or device-level signals once recognized by New Jersey regulators.

Practical steps for implementation:

• Persistent and easily accessible “Do Not Sell or Share My Personal Data” links
• Granular consent banners distinguishing functional, analytics, and advertising cookies
• Preference centers where users can update choices
• An opt-out platform or process to handle consumer requests and consumer deletion requests efficiently

Pandectes, a Google-certified consent management platform for Shopify, can centralize and record user consents and opt-outs across multiple jurisdictions, simplifying New Jersey compliance for global stores.

Comparing New Jersey’s Data Broker Law to Other States

Marketers often run national campaigns, so understanding how New Jersey’s data broker law fits alongside other state laws helps with scalable compliance design.

Feature	New Jersey A5328	California’s Delete Act	Connecticut / Vermont
Scope	Data brokers + data collectors	Data brokers (registration + centralized deletion)	Data brokers (no direct-relationship entities)
Sensitive data ban	Yes, broad	Regulated via CPRA thresholds	Partial restrictions
Per-record penalty	$50,000	Varies	Lower
Registration fees	Up to $1.5M	Lower	Lower
Deletion mechanism	Required	Centralized (DROP)	Universal deletion

New Jersey is distinctive in treating entities with direct consumer relationships (data collectors) similarly to data brokers when they monetize personal data. This will particularly affect retail, fintech, and media marketing programs. The California Privacy Protection Agency and the Federal Trade Commission continue to evolve guidance around protecting Americans’ data, and the Foreign Adversaries Act adds yet another layer for companies dealing with data from foreign adversaries. Seven states now have some form of data broker registration or regulation.

Marketers can future-proof by adopting baseline standards: data mapping, consent logs, broker and vendor due diligence, and the ability to process deletion requests and honor opt-out requests across all marketing systems. Pandectes’ focus on global privacy compliance positions merchants to adapt quickly as more states adopt New Jersey-style new regulations.

Conclusion

New Jersey’s new data broker law A5328 significantly impacts marketing by expanding regulatory scope to include both data brokers and data collectors, imposing strict registration requirements, and banning the sale of sensitive data without consent. Marketers must ensure compliance by auditing data flows, updating contracts, and enhancing consent management. Early preparation will help avoid severe penalties and align marketing practices with evolving privacy standards.