← ALL REGULATIONS
New Jersey Data Privacy Act cookie rules, and opt-out signals.
New Jersey lets sites set advertising cookies without opt-in consent, but consumers must be able to opt out of targeted advertising, the sale of their data and some profiling. Since July 2025, controllers have had to accept opt-outs of targeted advertising and sale sent through a universal opt-out mechanism the consumer chooses, such as Global Privacy Control (GPC).
NJDPA at a glanceOpt-out, opt-in for some data
- Applies to
- Controllers handling data of 100,000+ New Jersey residents a year (not counting payment-only data), or 25,000+ while earning any revenue or discount from selling it
- In force
- 15 January 2025, with universal opt-out mechanisms required from July 2025
- Enforced by
- New Jersey Attorney General, through the Division of Consumer Affairs
- Penalties
- Violations are unlawful practices under the Consumer Fraud Act: up to $10,000 for a first violation and $20,000 for each later one
WHAT NJDPA REQUIRES
What New Jersey asks of a site that uses advertising cookies.
THE RULEHonour universal opt-out mechanismsA controller that uses personal data for targeted advertising or sells it must let consumers opt out through a universal opt-out mechanism they choose, required from six months after the Act took effect.
WITH KATLAKatla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
THE RULEA clear opt-out of targeted advertising and saleSelling personal data or using it for targeted advertising must be disclosed clearly and conspicuously, together with how to opt out.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no New Jersey-specific label.
THE RULEConsent for sensitive data and for teenagersSensitive data, which in New Jersey includes financial account details and status as transgender or non-binary, needs consent. So do targeted advertising, sale and significant profiling for consumers the controller knows are aged 13 to 16.
WITH KATLAKatla has no age-specific flow, and its categories describe what cookies are for, not which data types they carry. A site that processes sensitive data or serves teenagers can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULEA privacy noticeThe notice must cover the categories of data processed and why, the categories of third parties it may go to, and how consumers can exercise their rights.
WITH KATLAKatla generates the cookie policy from the scan, with CCPA disclosures in CCPA mode. New Jersey-specific wording is not generated, so check the notice against the Act.
NJDPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does New Jersey require honouring Global Privacy Control?
- Since July 2025, controllers that sell personal data or use it for targeted advertising must accept opt-outs sent through a user-selected universal opt-out mechanism. The Act does not name one; Global Privacy Control is an example of such a signal.
- Is there still a cure period?
- No. Until 1 July 2026, the Division of Consumer Affairs had to give notice and 30 days to cure where a cure was possible, before bringing an action; that requirement has ended.
- Are there regulations under the Act?
- The Division of Consumer Affairs proposed rules in June 2025 (N.J.A.C. 13:45L), covering consumer rights, universal opt-out mechanisms and consent. Check the Division’s site for their current status before relying on them.
- Can consumers sue?
- No. The Attorney General has sole and exclusive authority to enforce the Act, and it creates no private right of action.
- How does Katla treat New Jersey visitors?
- Auto mode reads the visitor’s timezone, and US timezones get the CCPA banner with its opt-out and GPC handling. You can also set the site to US State Laws (CCPA) mode for everyone.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.