Senate Commerce Committee Statement to Senate Committee Substitute, Nos. 2316 and 4109 (May 18, 2026)

Summary

A Senate Commerce Committee statement to the Senate on the Senate Committee Substitute for Senate Bill Nos. 2316 and 4109, State of New Jersey, dated May 18, 2026, reporting the substitute favorably. The substitute prohibits a controller of a commercial Internet website or online services from selling sensitive data, requires data brokers to register with the Division of Consumer Affairs, and prohibits brokering of physical or behavioral health records. Data brokers would pay an annual registration fee of $5,500 or another amount set by regulation, and the division would keep a public registry. Failure to register carries a civil penalty of $2,500 for each day of noncompliance, and selling sensitive data in violation of P.L.2023, c.266 or the bill carries $50,000 for each record.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

SENATE COMMERCE COMMITTEE

STATEMENT TO

SENATE COMMITTEE SUBSTITUTE
FOR

SENATE, Nos.
2316 and 4109

STATE
OF NEW JERSEY

DATED: MAY 18,
2026

The Senate Commerce Committee reports favorably Senate
Committee Substitute for Senate Bill Nos. 2316 and 4109.

This substitute prohibits a controller of a commercial
Internet website or online services from selling sensitive data, which
prohibition will apply to all individuals or legal entities regardless of the
number of consumers whose data the individual or entity controls or processes.

The bill requires data brokers to register with the
Division of Consumer Affairs (division) in the Department of Law and Public
Safety and prohibits the brokering of physical or behavioral health records.

Under the bill, a data broker means a person or entity
that knowingly collects or purchases the personal data of a consumer with whom
the person or legal entity does not have a direct relationship and sells,
licenses or otherwise provides such data to third parties.

Specifically, the bill requires the division to
establish and maintain a public registry of data brokers doing business in New
Jersey. Data brokers are required to register with the division, pay an annual
registration fee of $5,500 or other amount established by the Director of
Consumer Affairs by regulation, and provide the division with certain
information about the data broker’s business as described in the bill.
Collected registration fees will be used to implement the provisions of the
bill.

Under the bill, the information that data brokers are
required to submit to the division at the time of registration includes:

(1) the data broker’s name and primary physical,
email, and Internet addresses;

(2) whether the data broker permits individuals to
opt out of the data broker’s collection practices and direct the data broker to
delete any personal data in the broker’s possession, including the method for
requesting an opt-out, the type of opt-out, whether the opt-out is limited to
certain activities or sales, whether the data broker permits individuals to
authorize a third party to opt out on the individual’s behalf, and the manner
in which individuals may confirm the deletion of personal data by the data
broker;

(3) a statement specifying the data collection,
databases, or sales activities from which an individual may not opt out;

(4) whether the data broker uses a credentialing
process for purchasers of data and, if applicable, a general explanation of
that process;

(5) a history of data breaches and other
cybersecurity events affecting the data broker and personal identifying
information in the data broker’s possession, including the number of
individuals affected by each such data breach or cybersecurity event;

(6) a separate statement detailing the data
collection practices, databases, sales activities, and opt-out methods that are
applicable to the personal identifying information of persons under the age of
18 and whether the data broker has actual knowledge that it possesses the
personal identifying information of persons under the age of 18; and

(7) any information the division deems appropriate to
implement the purposes of the bill.

Using the information submitted by data brokers, the
division is to include in the registry, at minimum, each data broker’s name and
physical address, a general email address that may be used to request
information about the data broker’s privacy policies and data collection
practices, a general Internet website address for the data broker, an Internet
website address specific to the data broker’s privacy policies, and any
relevant opt-out information. The division is required to review and update
this information at least annually.

Data brokers that fail to submit and update
information as required under the bill, or that fail to register and pay the
registration fee required under the bill, will be liable for a civil penalty of
$2,500 for each day the data broker is not in compliance.

A person or legal entity that knowingly collects or
purchases the personal data of a consumer with whom the person or legal entity
does not have a direct relationship and sells, licenses or otherwise provides
that data to third parties is not considered a data broker for the purposes of
the bill if:

(1) the full extent to which the person or entity
collects or purchases the personal data of a consumer with whom the person or
legal entity does not have a direct relationship and sells, licenses or
otherwise provides such data to third parties is incidental to conducting one
or more of the following activities:

(a) developing or maintaining a third-party
e-commerce or application platform;

(b) providing 411 directory assistance or directory
information services, including name, address, and telephone number, on behalf
of or as a function of a telecommunications carrier;

(c) providing publicly available information related
to an individual’s business or profession; or

(d) providing publicly available information via
real-time or near real-time alert services for health or safety purposes; or

(2) the person or entity is a financial institution
or an affiliate of a financial institution that:

(a) is only and directly engaged in financial
activities as described the federal Bank Holding Company Act;

(b) is regulated and examined by the State Department
of Banking and Insurance or an applicable federal bank regulatory agency; and

(c) has established a program to comply with all
applicable requirements of the New Jersey Department of Banking and Insurance
or the applicable federal bank regulatory agency concerning personal data.

A person or entity that engages in these activities
will still be considered a data broker for the purposes of the bill if the person
or entity collects and sells or licenses personal identifying information in
any way that is not incidental to one or more of those activities.

A data broker, including a controller, that sells,
offers for sale, licenses, or otherwise furnishes, provides, or transmits to
any other individual or sensitive data in violation of P.L.2023, c.266 or the
bill’s provisions will be liable to a civil penalty of $50,000 for each record
sold, offered for sale, licensed, or otherwise furnished, provided, or
transmitted.

File and source

File

2026-05-18_SCM_S2316_S1.htm

Size

9,552 bytes

SHA-256

e6f076eae6ddc6ec7895a08231fba8cb6ca26c2813fc05333371aae1c02fc57e

Our copy

2026-05-18_SCM_S2316_S1.htm

Original

No public link identified.