A law passed in 48 hours imposes the nation's steepest data penalties, but the Governor's office and the Attorney General cannot agree on whether it is enforceable.

A New Jersey law that the Legislature passed in less than 48 hours now imposes a flat $50,000 fine on each record of sensitive data that brokers sell or license — penalties that dwarf those of every other state. The Sherrill administration and the Attorney General's office are sending conflicting signals on whether the statute is enforceable, and the Legislature is unlikely to return to the chambers to repair it.

NGP VAN, a private data provider that manages the Democratic National Committee's voter file, warned it would withdraw from New Jersey rather than risk liability under the new statute. According to the New Jersey Globe, data vendors are weighing whether to suspend voter files and targeting products.

Wide-ranging law covers many categories

Commercial voter files layer public registration data with demographic, consumer and predictive information that campaigns, parties and labor unions license to identify likely supporters and turnout targets. The law prohibits selling or licensing sensitive data, and many targeting products rely on race, ethnicity, religion and precise geolocation,  categories the law now places off-limits.

The statute defines a "data broker" as a person or legal entity that knowingly collects or purchases personal data from consumers with whom it lacks a direct relationship, then sells or licenses that data to a third party. A "data collector" is a business that collects personal data from consumers it has a direct relationship with and then sells or licenses that data to a broker.

The law also prohibits selling or licensing sensitive data across categories that extend well beyond the political sphere, from health records and financial credentials to children's information and precise geolocation.

Campaigns may still deploy geofencing at churches and union halls, rallies and polling places if they steer clear of acquiring or leasing banned location data. But according to the Globe, the law offers no guidance on whether data gathered by volunteers or paid canvasser files count as regulated data.

Bill introduced less than 48 hours before budget deadline

Assemblyman Bill Moen (D, 5th District) introduced the bill on Sunday, June 28, and the Democrat-controlled Legislature passed it in under 48 hours, just before the constitutional budget deadline of June 30. The legislative push meant that the bill was law before companies could prepare for the new guidelines. Both chambers approved it along party lines on Tuesday, June 30, and the governor signed it that day. 

The statute took effect immediately. Republican lawmakers opposed it as anti-business, while Democratic supporters in the legislature positioned the measure as a revenue source for the $60.7 billion budget. But the rush left legislators on both sides overlooking how it would affect campaigns.

The statute requires annual registration fees, ranging from $5,000 for small operators to $1.5 million for brokers handling more than 4.5 million consumer records. New Jersey counts nearly 6.7 million registered voters, so a single broker processing the state voter file would pay the top rate. California's registration fee runs about $6,000. Texas charges $300 to register, with penalties capped at $10,000 per year.

Assemblywoman Victoria Flynn (R, 13th District) called the fees "extraordinarily high" and said they "well exceed anything else in this country."

The law imposes a $2,500 daily civil penalty for noncompliance, as well as fines for violations of $50,000 for each record of sensitive data that a broker sells, offers or licenses. At what the New Jersey Globe called the "most absurd extreme," a company handling all 6.7 million voter records would face a $333 billion penalty.

Senator John McKeon (D, 27th District) told Bloomberg Law that he rewrote the fee schedule in the same rush between its introduction and the budget deadline. Where the original bill had projected $2.5 million in new revenue, McKeon's version carried a $50 million estimate.

"That part was economic... That was to help us meet our constitutional obligation to balance the budget and this was an excellent source," McKeon told Bloomberg Law. "The timing of the bill and the amended registration fees were little more than a combination of 'good policy' and revenue generation."

The New Jersey Globe heard a different account from anonymous lawmakers and staffers, who pointed to Governor Mikie Sherrill's office as the origin of the revenue push. Sherrill's office did not immediately respond to the New Jersey Globe's request for comment.

The Office of Legislative Services produced a fiscal estimate on July 2, 2026, that could not verify McKeon's $50 million projection. The nonpartisan office said it had no empirical basis to quantify the revenue increase, noting that annual receipts might fall anywhere from a few million to tens of millions of dollars. The document explained the circumstances: "This legislative fiscal estimate has been produced by the Office of Legislative Services due to the failure of the Executive Branch to respond to our request for a fiscal note."

Consumer Affairs says registrations paused until next year; AG and Governor diverge on enforcement

On July 10, 2026, the New Jersey Division of Consumer Affairs posted an alert that delayed the public registry until spring 2027. The Globe described the notice as difficult to locate and dense with legal language. According to the statement, covered brokers and collectors will not have to register or pay fees until the new deadline. The DCA alert stopped short of suspending the $50,000-per-record penalty for selling sensitive data, leaving the penalty live. But a senior Sherrill administration official told the Globe that the state would not enforce the law. 

On July 12, Attorney General Jennifer Davenport's office, which manages DCA, signaled a different approach than the Governor. Press secretary Michael Symons said the office would evaluate each matter on its own merits: "Consistent with our office's longstanding practice, we will continue to evaluate all enforcement matters on a case-by-case basis, taking into account the facts and the law in every case." Symons directed reporters to the Division of Consumer Affairs alert for additional guidance.

Assemblyman Moen, who introduced the original bill, told the New Jersey Globe he expected the Division of Consumer Affairs to use the rulemaking period to prevent unintended consequences. "Traditionally, there has been an exemption for data used in connection with First Amendment political speech," Moen said. "It's obvious in this law that we are giving the Division of Consumer Affairs the responsibility to develop rules and regulations, and I would expect them to use that period of time to ensure there are no unintended consequences in the implementation of this law." Moen added that his work on the bill was aimed at holding "bad actors, who are abusing our personal data, accountable."

An anonymous lawmaker gave the Globe a different picture: "I don't know how they fix this... The governor can't call the legislature into an emergency summer session to fix a fuck-up that affects political campaigns. Those optics suck."

Assemblyman Al Barlas (R, 40th District) said he was not surprised a bill rushed on a Sunday night contained errors: "When you try to rob a bank in the dark, you grab the dye pack."

Micah Rasmussen, director of the Rebovich Institute of New Jersey Politics at Rider University, also addressed the confusion. "For a political campaign, it is the equivalent of a nuclear bomb," he said.  Rasmussen tied the crisis to the Legislature's habit of rushing bills: "For too many years to count, legislatures and governors have ignored disapproval and criticism of passing laws in the dead of night, without time to scrutinize the unintended consequences of their actions," he said. "Now it may have finally bitten them where it counts."

Data brokers need not register until the division opens the registry in spring 2027, yet the $50,000 penalty took effect immediately, at least on paper. One law firm, Baker Donelson, noted that "the $50,000-per-record penalty is already in effect and subject to enforcement – no grace period, no phase-in." But the Governor and Attorney General dispute whether the penalty will actually be enforced between now and next spring. 

For now, the 2026 campaign cycle proceeds with no clarity on which data practices are legal, and it remains unclear which vendors will remain when the registry finally opens. Whether the Legislature will return to repair what it broke in 48 hours is an open question.

Related Articles

• Sherrill's $60.7B Budget Passes as GOP Calls Process a 'Disaster'

• AG Davenport Issues Rules for ICE Visits to NJ Schools, Hospitals

• Sherrill Unveils Four-Pillar Data Center Plan as Municipal Bans and Grid Pressure Mount

Sources

• Baker Donelson, "New Jersey Enacts Ban on Sensitive Data Sales by Data Brokers and Data Collectors" (July 7, 2026)

• Bloomberg Law, "New Jersey's Highest-in-Nation Data Broker Fees Shock Industry" (July 10, 2026)

• David Wildstein, New Jersey Globe, "Confusion persists over enforcement of N.J. data privacy law" (July 12, 2026, 6:44 pm)

• David Wildstein, New Jersey Globe, "N.J. campaigns brace for voter data shutdown under new law" (July 10, 2026, 1:30 pm)

• David Wildstein, New Jersey Globe, "Sherrill administration will suspend enforcement of new data law" (July 10, 2026, 7:01 pm)

• NJ Division of Consumer Affairs, Alerts Page, "Data Broker Registration" (July 10, 2026)

• NJ Legislature, Assembly Bill No. 5328, "Regulates data brokers, data collectors, and collection and dissemination of certain sensitive information" (introduced June 28, 2026; passed June 30, 2026; signed June 30, 2026)

• Office of Legislative Services, Legislative Fiscal Estimate, Assembly No. 5328 (July 2, 2026)