New Jersey Data Privacy Act

New Jersey has enacted Bill 332, becoming the 14th state to have a comprehensive state privacy law. The law, effective from January 2025, applies to controllers conducting business in New Jersey or targeting New Jersey residents. It includes obligations for controllers such as data minimization, privacy notice requirements (including a reasonably accessible, clear, and meaningful privacy notice), obtaining consumer consent for sensitive data, and implementing data security practices. The law also introduces a universal opt-out mechanism for targeted advertising or data "sale" and standard consumer rights.