Law note · New Jersey
New Jersey Data Privacy Act, consumer rights and universal opt-out
New Jersey consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials. A controller must act within 45 days of receipt, extendable once by 45 additional days, and must communicate a denial within 45 days with appeal instructions.
Beginning around July 15, 2025 (six months after the general effective date), a controller processing personal data for targeted advertising or sale must allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism, a staged duty confirmed directly from the Act's own text as distinct from the general effective date.
What it asks of an app
- Give a New Jersey consumer a means to confirm, access, correct, delete, and port their personal data, and respond within 45 days of receipt (extendable once by 45 days).
- Recognize a user-selected universal opt-out mechanism for targeted advertising and sale of personal data. This duty became operative around July 15, 2025, separately from NJDPA's general effective date.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official New Jersey session law text, P.L. 2023, c. 266, New Jersey Legislature