New Jersey's data broker law just made most publishers "data collectors"

New Jersey passed a data broker law in June over the course of just two days, and it took effect immediately, with a feature no other state has tried: a new "data collector" category that goes after the source of data, not the middlemen. The bar to qualify is low enough to catch ordinary publishers. "There's no minimum thresholds," Jodi Daniels, CEO of privacy consultancy Red Clover Advisors, told AdExchanger. If you sell or license reader data onward to even one company that qualifies as a broker, you are in scope, and "sale" is defined broadly enough to capture "many routine ad tech arrangements" even when no money changes hands. Registration with the state is due by April 2027, with a public registry and tiered annual fees running from $5,000 for up to 100,000 New Jersey consumers to $1.5 million above 4.5 million, according to Daniel Rosenzweig of DBR Tech Law. Celine Guillou, special counsel at Kelley Drye, put the blunt point: "Simply proclaiming 'We only use first-party data' is no longer an option. The real question is how data moves through the publisher's ecosystem." A sensitive-data ban covering health, precise geolocation and biometric data has been live since June 30, and while a Sherrill administration official anonymously floated a temporary enforcement pause in July, the state's Division of Consumer Affairs has confirmed registration opens April 1, 2027.

The crux

New Jersey has redefined the publishers that sell or license reader data onward as "data collectors," pulling them into registration, public disclosure and fees up to $1.5 million a year, so publishers who assumed a first-party data relationship kept them exempt are now exposed to a compliance obligation they never budgeted for.

Sell-side read

Every publisher monetising reader data through downstream partners needs a data-flow inventory before April 2027: audit resolution, onboarding, enrichment and licensing, because the trigger is who you share with, not what you collect. If the value of a given data arrangement is outweighed by the registration fee and compliance burden, Guillou's own words apply: publishers may reconsider it.

Watch

Whether New Jersey's enforcement pause becomes a permanent carve-out before the April 1, 2027 registration window, and whether Connecticut, Vermont and the federal SECURE Data Act follow the same source-of-data model.