◈MCStanding

Are you in scope under New Jersey's data broker law?

New Jersey's A5328 is the first US data broker law that also regulates data collectors — businesses that sell their own customers' data onward to a broker. Every other state turns on the absence of a direct relationship, so the companies most likely to be caught here are the ones that have correctly concluded they are not data brokers anywhere else.

Four questions. No signup, no email, nothing to install. The answers stay in this page — this site cannot open a network connection, so there is nowhere for them to go.

The check

The dates, whichever answer you got

WhenWhat changes
30 Jun 2026
in force		 New Jersey — selling or licensing sensitive data is prohibited outright. $50,000 per record. No exception for disclosures to processors or for third-party service provision.
1 Oct 2026 Connecticut's act takes effect, including its outright ban on selling precise geolocation data and its ban on surveillance pricing.
1 Jan 2027 Vermont — fee rises $100 to $900, a $20,000 surety bond is required, and the penalty goes from $50 a day capped at $10,000 a year to $200 a day uncapped, plus $25,000 for materially incorrect information. Connecticut registration opens.
27 Mar 2027 New Jersey registration opens. Fees $5,000 to $1,500,000 a year by volume; $2,500 a day uncapped for not registering.
1 Jul 2028 Connecticut's own deletion platform goes live on a 45-day cadence — and it verifies consumers, where California forbids verifying them. One process cannot satisfy both.

Dates and amounts reviewed against the statutes and published analyses on 24 September 2026. This is compliance software, not legal advice — the definitions below are the statutory ones, but whether they catch your business is a question for your counsel.

Why this one is different

What exactly is a “data collector”?
A business that knowingly collects personal data from a consumer it does have a direct relationship with — a customer, client, subscriber or user — and then sells or licenses that data to a data broker. If you sell your own customer list onward to someone who resells data, that is the category, and it carries the same registration duty as being a broker.
I am not a data broker anywhere else. Does that help?
Not here, and that is the trap. California, Texas, Oregon and Vermont all define a broker by the absence of a direct relationship with the consumer. New Jersey kept that definition and then added a second one that turns on the presence of one. The two categories together cover both sides of the same transaction.
We are too small for the state privacy law thresholds.
The sensitive-data prohibition applies regardless of the size thresholds that otherwise gate the New Jersey privacy law. Being under them does not exempt you from it.
Why is the ban live when the registry is not?
Because they have different effective dates and most coverage leads with the registry. Most of A5328 took effect on enactment, 30 June 2026. The registry is created 270 days after that. A reader who sees only the 2027 date would reasonably conclude there is nothing to do yet.
How would I check any of this without trusting you?
Read the statute, and read this page's response headers. The app this sits in front of sends connect-src 'none', which means the page cannot open a network connection at all. Your security reviewer can confirm that in about ten seconds without reading our code.
Open the app — free, no signup Pricing