Prohibits controller of commercial Internet website or online service from selling sensitive personal data.
Summary
S4109 amends New Jersey’s existing consumer data privacy law to add a clear prohibition on the sale of sensitive personal data by a controller of a commercial Internet website or online service. The bill defines sensitive data broadly to include information such as racial or ethnic origin, religious beliefs, health information, financial account data, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, biometric or genetic data, data from known children, and precise geolocation data. It also states that the ban applies regardless of how many consumers’ data a person or entity controls or processes.
The bill also reinforces and restates several existing controller duties under P.L.2023, c.266, including limits on data collection, restrictions on incompatible processing, security safeguards, consent requirements for sensitive data, revocation of consent, limits on targeted advertising and profiling for teens ages 13 to 16, and requirements to conduct data protection assessments for processing that presents a heightened risk of harm. The new language specifically adds the sale of sensitive data to the list of prohibited practices and treats that activity as a heightened-risk processing category for assessment purposes.
Impact
This bill would amend section 9 of New Jersey’s 2023 consumer privacy law, expanding the obligations of data controllers and commercial online services. Its primary legal effect is to bar the sale of sensitive personal data and to make that prohibition apply broadly to all covered entities, not just larger data brokers or companies above a consumer threshold. It would also preserve the Division of Consumer Affairs’ authority to review confidential data protection assessments upon request and would continue to expose covered controllers to enforcement under the state’s consumer privacy framework.
Sentiment
The bill text and available context suggest a generally protective, privacy-focused policy approach with no recorded committee debate or votes in the provided materials. The measure appears designed to strengthen consumer privacy rights and limit monetization of highly personal information, which typically aligns with concerns about online tracking, data brokerage, and misuse of sensitive information. Because there are no transcripts or vote records included, there is no documented opposition or support to characterize beyond the bill’s clear consumer-protection orientation.
Contention
The main point of potential contention is the breadth of the sensitive-data sale ban and its application to all controllers regardless of size or volume of data processed. Businesses that rely on data-driven advertising, analytics, or data monetization may view the restriction as burdensome or overly expansive, especially because the bill also treats the sale of personal data as a heightened-risk activity subject to assessment. Privacy advocates, by contrast, would likely support the measure as a necessary safeguard against exploitation of intimate or identifying information, particularly for minors and other vulnerable consumers.