Gothamist
A non-profit newsroom, powered by WNYC.
Gothamist
Listen Live
News
New NJ law says websites must ask about using your data. Businesses, news orgs worry about lawsuits.
By
Nancy Solomon
Published Jan 27, 2024
Share
FacebookTwitterRedditEmail
Never miss a story
Email address
By submitting your information, you're agreeing to receive communications from New York Public Radio in accordance with our Terms .
Morsa Images / Getty Images
By
Nancy Solomon
Published Jan 27, 2024
Share
FacebookTwitterRedditEmail
We rely on your support to make local news available to all
Make your contribution now and help Gothamist thrive in 2026. Donate today
Gothamist is funded by sponsors and member donations
Companies operating in New Jersey will have to inform consumers when they are collecting their personal information online — and allow them to opt out — starting in mid-2025.
New Jersey becomes the 13th state to pass similar data privacy rules, and several other state legislatures have pending bills. But some business leaders and the state’s largest press organization say New Jersey’s new requirements go further than other states, and language in the bill may open the door to excessive litigation.
Any website that collects data from more than 100,000 people per year is now required to inform each consumer and provide an opt-out option, according to the bill, which Gov. Phil Murphy signed on Jan. 17. The threshold is lowered to 25,000 consumers a year if the website is selling personal data.
State data privacy laws have come under fierce lobbying efforts by tech companies, including Amazon, Google and Meta. The companies spent more than $50 million in 2022 on federal lobbying around issues such as privacy and competition, and a federal bill to institute similar protections stalled out in 2022 after receiving bipartisan support, Bloomberg reported last year. The tech companies have also heavily lobbied state legislators.
New Jersey’s law is considered one of the strictest in the nation, according to state Sen. Raj Mukherji, a Jersey City Democrat, who sponsored the bill in the last legislative session, when he was an assemblymember.
“It has the strongest universal opt-out mechanism of any data privacy law in the country,” Mukherji said. “And it just puts consumers back in control of their own data.”
In general, when a website complies with a state’s privacy laws, a message appears informing the user that personal data is being collected, and providing an opportunity to opt out. The data collected can range from highly personal information collected on a dating or health app to information about what a person reads, buys or subscribes to online.
New Jersey’s law goes further than other states, Mukherji said, because companies are required to explicitly ask customers to opt in before collecting data on certain types of highly sensitive information, such as biometric data gathered by a health app. But the law doesn't specify how sites and apps must ask for permission, and instead leaves that decision up to the companies.
“This important legislation will help consumers reclaim control over their own personal data, and allow them the choice to share information that is personal to them,” Murphy said in a press release after signing the bill.
The bill was in the works for two years and then rushed to the finish line on the last day of the 2022-23 legislative session with amendments that upset the New Jersey Business and Industry Association.
“The business community supports data privacy for consumers. We just want a bill, or a law, that is going to work,” said Ray Cantor, a lobbyist with the group. “There are vague terms in the bill. There's conflicting provisions.”
For example, Cantor said the term “financial data” is not defined in the bill, and can mean different things. He added some of the language in the New Jersey bill differs from other states on how different kinds of data must be handled, making it hard for businesses that operate nationally to make their system conform with other state laws.
Legislators removed language that dealt with litigation over privacy violations. Cantor said a company that does business across state lines could be tripped up by the differences between states’ rules, and potentially be sued for it.
“We were very comfortable in letting violations be enforced by the Office of the Attorney General,” Cantor said. “What we did not want and what we think that the bill now allows is for private attorneys to bring class action lawsuits for technical violations, and that is very concerning. It doesn’t promote data privacy. It doesn't help anyone other than those lawyers who are bringing these types of lawsuits.”
But Mukherji said the law will indeed be enforced by the attorney general, and that the removed language would have excluded consumers from filing lawsuits related to previous privacy laws.
“We're not going to take away consumers' rights under other existing frameworks and make them worse off. I mean, that wasn't fair,” Mukherji said. “So that argument is a red herring to me.”
Murphy noted the criticism from the business lobby in his signing statement.
“I understand that concerns have been raised that removing that language thereby establishes a private right of action under other laws for violations of this bill,” Murphy wrote. He added that nothing in the bill expressly establishes a right for consumers to sue, and that the attorney general would establish appropriate measures to take action against violators.
Earlier this month, the New Jersey Press Association, which represents hundreds of newspapers and other newsrooms, wrote the governor a letter asking him to veto the bill over concerns that it “captures professional newsgathering activities” — and could potentially let a person try to get a news organization to remove or change information published about them, despite First Amendment protections.
The press association sought language in the bill saying it wouldn’t apply to anyone working professionally in news media “for the purpose of gathering, procuring, transmitting, compiling, editing or disseminating news for the general public.” And it cited exemptions in other state's laws specifically exempting journalism.
But Mukherji said there is nothing in the law that would impinge on journalism in New Jersey.
The attorney general's office will hold public hearings before it writes the detailed regulations that determine exactly how the new law will work, a process that all bills go through, Mukherji said. The law goes into effect in January 2025, with enforcement actions beginning six months later.
Tagged
business
new jersey
Politics
Health and Science
Nancy Solomon
Read more
Gothamist is funded by sponsors and member donations
Gothamist is funded by sponsors and member donations
MORE news
Man shot and killed on Midtown subway platform Saturday afternoon, NYPD says
Police said they're searching for a person of interest.
By
Ryan Kost
and
Elizabeth Kim
Published Oct 17, 2026 at 1:16 p.m. ET
Modified Oct 17, 2026 at 4:10 p.m. ET
Have you seen this Yorkie? NYPD looking for adorable pup dognapped from her Queens home
Suspects were driving a Subaru Forester, police said.
By
Ryan Kost
News
Have you seen this Yorkie? NYPD looking for adorable pup dognapped from her Queens home
Suspects were driving a Subaru Forester, police said.
By
Ryan Kost
Being reigning champions is weird for Knicks fans, but we could get used to this.
By
Catalina Gonella
Tompkins Square Park is getting a makeover. Some say it's too much.
By
Willow Higgins
Deer are all over New Jersey roads looking for sex, state officials warn
By
Rosemary Misdary
Never miss a story
Catch up on the most important headlines with a roundup of essential NYC stories, delivered to your inbox daily.
Sign upEmail address
By submitting your information, you're agreeing to receive communications from New York Public Radio in accordance with our Terms .