Repost - Amid Industry Backlash, Some Say NJ Data Broker Law Adds Important Consumer Protections

Originally posted on Privacy Daily on Monday, July 20, 2026

Two consumer privacy advocates defended a New Jersey data broker law that has come under fire from business groups for its relatively large registration fees and total ban on selling sensitive data. But the law’s possibly significant revenue impact for apps and other businesses that sell their customers’ location information for advertising makes litigation over the law seem certain, privacy attorney Brandi Bennett told Privacy Daily on Monday.

With its wider scope and tiered registration fees, New Jersey’s new law stands to increase transparency for consumers about who has their data, argued Emory Roane, Privacy Rights Clearinghouse associate director of policy, in an email Friday. On Monday, ACLU of New Jersey Staff Attorney Dillon Reisman said that the law “accomplishes the important task of placing a real limit on the abuse of New Jerseyans’ sensitive data.”

However, associations for advertisers, political consultants and technology companies raised big concerns with the state law after it was signed and took effect June 30 (see 2607160055 and 2607090011). In-House Privacy Inc. attorney Ben Isaacson said in an interview Friday that he’s getting “a lot of calls” about the law from his “surprised” clients. The law could violate multiple parts of the U.S. Constitution, he said.

Litigation is “inevitable with this much money at play,” said Bennett, who noted that she once worked “on the dark side of privacy” for a company that sold geolocation data. Bennett now advocates for bans on selling that type of sensitive information. Weather and other popular apps have sold consumers’ location data for 20 years, she said. “There are trillions of dollars invested in ... behavioral ad tech” and “multiple billions” in geolocation specifically.

ACLU’s Reisman said many New Jersey consumers aren’t “aware of the ecosystem of companies and data brokers that collect and resell vital and intimate personal information, even including their location as tracked by their cell phones. The abuse of this data has severe civil liberties and civil rights implications.”

Roane argued that the new state law gives more insights into how consumers’ data is bought and sold. For example, many have sounded the alarm over the law’s broad scope, which applies not only to data brokers, which don’t have direct relationships with customers, but to “data collectors” that do. Roane said the “registration requirement for businesses that sell to data brokers is definitely novel, but I think it gets at something these registries have been missing.”

“So much of what data brokers sell started life in a first-party relationship, and a consumer who shopped at their local pharmacy ... is a world apart from knowing their purchase history is being sold into the broker market,” the consumer advocate said. “That visibility is the whole reason these registries exist.”

For a similar reason, Roane also supported New Jersey’s novel concept of a tiered structure for registration fees. The sliding scale of fees will “help us all better understand the difference in scale amongst these companies,” the consumer advocate said. California’s registry lists more than 580 data brokers but “you can’t tell which ones hold a few thousand records and which ones hold records on basically every adult in the country.”

In terms of the law’s reach, Roane said it’s important to note it “only covers first parties that actually sell to brokers. If you collect data from your own customers and keep it in-house, the law doesn’t touch you, and if this pushes more companies to do that instead of treating their customer data like a source of revenue, good.”

Isaacson countered that he doesn’t think “people who aren’t ... advising marketing industries understand how broad that [data collection] language is and how many companies it applies to.” If a company is a newspaper or any other kind of “ad-supported business, then you more than likely are going to be using an intermediary to represent your audience and enrich your audience to create more targeting capabilities,” the lawyer said. That makes them a data collector under New Jersey’s law, he added.

Registration Fees or Unconstitutional Taxes?

Roane defended the law’s registration fees, which go from $5,000 to $1.5 million depending on how much consumer data a company collects. But Isaacson said the fees may be unconstitutional taxes.

New Jersey’s bottom tier of $5,000 “is actually less than the $6,000 California charges every broker this year. So, the small brokers are getting a better deal than they would in [California],” Roane said. The seven-figure registration fees “don’t kick in until a company is monetizing data on over a million [New Jersey] residents, roughly one in nine people in the state,” he said. “I'll admit I don’t have much sympathy there.”

The fees could knock out small data brokers that have a few employees yet hold millions of consumer records, said Bennett: But one must ask, “Do we actually want this business to exist?”

Meanwhile, applying high fees to data collectors gets at uses of data the consumer may not have known they were consenting to, the attorney said. For example, “you consent to Weather.com using your data to serve you weather ... You don’t consent to Weather.com selling that data back to a data broker ... who then sells it to 450,000 other customers.” The average user “consents to that first-order use,” not to a company “selling it to everybody else down the chain.”

Isaacson, however, said the law’s registration fees raise Fifth and 14th Amendment concerns. “This is about a discriminatory tax on a particular industry for really a fiscal purpose, not ... to address the harm.” News reports indicate that “the lawmakers who wrote the law were doing this explicitly for a budget shortfall,” said Isaacson: It seems to be “designed to take money from large ad tech companies exclusively to fill a budget shortfall in New Jersey.”

It also doesn’t make “sense from an interstate commerce perspective,” he said. “You just can’t ... have a law” that seeks to “extract $50 million from the advertising industry ... and then have that replicated across 50 states.”

Isaacson suggested that, rather than rely on registration fees, New Jersey could instead have followed California’s example and looked to non-registration penalties to generate revenue.

However, Roane said it’s “worth remembering that California’s $6,000 [flat registration fee] comes with a dedicated privacy agency behind it,” with a $15.7 million budget and more than 50 staff. New Jersey lacks a privacy agency, and a less-resourced division of the AG’s office will be enforcing registrations. “The fee revenue is what’s going to pay for the program.”

Still, Isaacson pointed out that California’s attorney general has “done as many enforcement actions” as the privacy agency. Also, he argued that New Jersey could raise significant revenue by penalizing just one non-registered company.

A Novel Ban on Sensitive Data Sales?

While the law’s registration fees have received most of the attention, Isaacson said its outright ban on selling precise location and other sensitive data is “equally troublesome,” especially given its immediate effect. “Companies are ... scrambling right now to figure out [if they] need to really try to geofence and do the things that are required.”

However, Roane said New Jersey’s ban on selling sensitive data is “not as novel as it’s being made out to be.” For example, he said, “Oregon has flatly banned selling precise geolocation and minors’ data since January, and Maryland banned the sale of sensitive data outright last October.”

Isaacson responded, “When it was just Maryland,” this type of ban looked like “the sort of thing [that] maybe slipped through the cracks.” But “now that it’s been replicated and [put into] effect within four days, we really do need to look more closely at the nature of the ban and whether it is constitutional by itself.”

He argued that the prohibition may violate the First Amendment by broadly applying “to all types of businesses without identifying a particular harm.” Courts have long been clear that restrictions must be “narrowly tailored with a strict-scrutiny analysis,” he said. Under this state law, however, local restaurants won’t be able to target ads to people nearby “while they're looking for restaurants in a particular app” if that app is “selling that location data to ... an ad tech platform,” he said. “That’s ... chilling the speech of those local businesses to be able to ... engage with a receptive audience.”

Bennett disagreed. “A lot of times when people don’t have a great argument, they ... fall back on the First Amendment, and they say that this is restricting speech,” said the lawyer: But “using people’s data against them is not speech.”

The ban on selling sensitive data is a key element of the New Jersey law, she said. “I've been telling people for years [that] precise geolocation is digital plutonium ... Geolocation is very essential to a number of critical applications, but it’s also extremely weaponized and dangerous when it’s weaponized.”

New Jersey set a “very tight purpose limitation,” Bennett added. “This doesn’t hurt Google Maps,” DoorDash or Weather.com, she said. “It hurts the advertisers, and it hurts the data brokers.”

Isaacson noted there maybe ways to resolve concerns with the law besides litigation.“There’s a lot of conversation about how to work with the legislature” and the governor to “figure out... what is the real agenda here, and can we address it in other ways?”

—Adam Bender

Reprinted with permission of Warren Communications News, Inc. and International Trade Today, 800-771-9200. https://warren-news.com and https://privacydaily.com

Copyright© 2026 by Warren Communications News, Inc., a Washington, DC business. Reproduction or retransmission in any form, without written permission, is a violation of Federal Statute (17 USC 101 et seq.).