Statement to Senate Committee Substitute, Nos. 2316 and 4109 — Senate Commerce Committee

Summary

Statement to Senate Committee Substitute for Senate, Nos. 2316 and 4109, from the Senate Commerce Committee of the State of New Jersey, dated May 18, 2026, reporting the substitute favorably. The statement says the substitute prohibits a controller of a commercial Internet website or online services from selling sensitive data, and requires data brokers to register with the Division of Consumer Affairs and pay an annual registration fee of $5,500 or another amount set by regulation. It states a civil penalty of $2,500 for each day of noncompliance, and $50,000 for each record sold in violation.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

     SENATE COMMERCE COMMITTEE

                     STATEMENT TO

 SENATE COMMITTEE SUBSTITUTE FOR
          SENATE, Nos. 2316 and 4109

 STATE OF NEW JERSEY
                        DATED: MAY 18, 2026

     The Senate Commerce Committee reports favorably Senate
Committee Substitute for Senate Bill Nos. 2316 and 4109.
     This substitute prohibits a controller of a commercial Internet
website or online services from selling sensitive data, which
prohibition will apply to all individuals or legal entities regardless of
the number of consumers whose data the individual or entity controls
or processes.
     The bill requires data brokers to register with the Division of
Consumer Affairs (division) in the Department of Law and Public
Safety and prohibits the brokering of physical or behavioral health
records.
     Under the bill, a data broker means a person or entity that
knowingly collects or purchases the personal data of a consumer with
whom the person or legal entity does not have a direct relationship and
sells, licenses or otherwise provides such data to third parties.
     Specifically, the bill requires the division to establish and maintain
a public registry of data brokers doing business in New Jersey. Data
brokers are required to register with the division, pay an annual
registration fee of $5,500 or other amount established by the Director
of Consumer Affairs by regulation, and provide the division with
certain information about the data broker’s business as described in the
bill. Collected registration fees will be used to implement the
provisions of the bill.
     Under the bill, the information that data brokers are required to
submit to the division at the time of registration includes:
     (1) the data broker’s name and primary physical, email, and
Internet addresses;
     (2) whether the data broker permits individuals to opt out of the
data broker’s collection practices and direct the data broker to delete
any personal data in the broker’s possession, including the method for
requesting an opt-out, the type of opt-out, whether the opt-out is
limited to certain activities or sales, whether the data broker permits
individuals to authorize a third party to opt out on the individual’s
behalf, and the manner in which individuals may confirm the deletion
of personal data by the data broker;
                                   2

    (3) a statement specifying the data collection, databases, or sales
activities from which an individual may not opt out;
    (4) whether the data broker uses a credentialing process for
purchasers of data and, if applicable, a general explanation of that
process;
    (5) a history of data breaches and other cybersecurity events
affecting the data broker and personal identifying information in the
data broker’s possession, including the number of individuals affected
by each such data breach or cybersecurity event;
    (6) a separate statement detailing the data collection practices,
databases, sales activities, and opt-out methods that are applicable to
the personal identifying information of persons under the age of 18
and whether the data broker has actual knowledge that it possesses the
personal identifying information of persons under the age of 18; and
    (7) any information the division deems appropriate to implement
the purposes of the bill.
    Using the information submitted by data brokers, the division is to
include in the registry, at minimum, each data broker’s name and
physical address, a general email address that may be used to request
information about the data broker’s privacy policies and data
collection practices, a general Internet website address for the data
broker, an Internet website address specific to the data broker’s
privacy policies, and any relevant opt-out information. The division is
required to review and update this information at least annually.
    Data brokers that fail to submit and update information as required
under the bill, or that fail to register and pay the registration fee
required under the bill, will be liable for a civil penalty of $2,500 for
each day the data broker is not in compliance.
    A person or legal entity that knowingly collects or purchases the
personal data of a consumer with whom the person or legal entity does
not have a direct relationship and sells, licenses or otherwise provides
that data to third parties is not considered a data broker for the
purposes of the bill if:
    (1) the full extent to which the person or entity collects or
purchases the personal data of a consumer with whom the person or
legal entity does not have a direct relationship and sells, licenses or
otherwise provides such data to third parties is incidental to conducting
one or more of the following activities:
    (a) developing or maintaining a third-party e-commerce or
application platform;
    (b) providing 411 directory assistance or directory information
services, including name, address, and telephone number, on behalf of
or as a function of a telecommunications carrier;
    (c) providing publicly available information related to an
individual’s business or profession; or
    (d) providing publicly available information via real-time or near
real-time alert services for health or safety purposes; or
                                     3

    (2) the person or entity is a financial institution or an affiliate of a
financial institution that:
    (a) is only and directly engaged in financial activities as described
the federal Bank Holding Company Act;
    (b) is regulated and examined by the State Department of Banking
and Insurance or an applicable federal bank regulatory agency; and
    (c) has established a program to comply with all applicable
requirements of the New Jersey Department of Banking and Insurance
or the applicable federal bank regulatory agency concerning personal
data.
    A person or entity that engages in these activities will still be
considered a data broker for the purposes of the bill if the person or
entity collects and sells or licenses personal identifying information in
any way that is not incidental to one or more of those activities.
    A data broker, including a controller, that sells, offers for sale,
licenses, or otherwise furnishes, provides, or transmits to any other
individual or sensitive data in violation of P.L.2023, c.266 or the bill’s
provisions will be liable to a civil penalty of $50,000 for each record
sold, offered for sale, licensed, or otherwise furnished, provided, or
transmitted.


File and source

File

2026-05-18_SCM_S2316_S1.pdf

Size

124,492 bytes

SHA-256

b92c7e65718e9b2d2bf8966af3b9d8cc4932bafecd5268eab6f7a827921817dd

Our copy

2026-05-18_SCM_S2316_S1.pdf

Original

No public link identified.