If you've ever wondered how your health information, immigration status, or exact location ends up for sale online, New Jersey just gave you a preview of where the rest of the country may be headed.
On June 30, 2026, Governor Mikie Sherrill signed A5328 into law, banning the sale of sensitive personal data in New Jersey and creating a first-of-its-kind public registry of the data brokers and data collectors operating in the state. It's one of the most aggressive data broker laws passed by any state so far — and it's a sign of where consumer privacy law is trending nationwide.
What A5328 Actually Does
The law prohibits selling sensitive personal data, regardless of whether the consumer technically "consented" somewhere in a privacy policy nobody reads. Under A5328, "sensitive data" includes things like:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health conditions
- Financial account numbers, login credentials, or security codes
- Sexual orientation or gender identity, including transgender or non-binary status
- Citizenship or immigration status
- Genetic or biometric identifying data
- Children's personal data
- Precise location information
On top of the sale ban, the law sets up a public registry that two kinds of companies will eventually have to join: data brokers (who buy and resell data on people they have no direct relationship with) and data collectors (companies you actually do business with, who turn around and sell your information to brokers). Registration will require brokers to disclose their contact information, opt-out procedures, breach history, and how they vet who they sell to — and registration fees scale with how many consumers' data a company handles, ranging from $5,000 up to $1.5 million a year for the largest operators. The registry itself is expected to open in spring 2027, with penalties up to $50,000 per record for illegal sales and $2,500 per day for skipping registration.
New Jersey Isn't Alone
This is part of a bigger pattern. Six states now have some form of data broker registry — Vermont, California, Texas, Oregon, Connecticut, and now New Jersey — and a growing number are going further than "you can opt out" and moving toward "this category of data simply can't be sold," even with consent on file. Connecticut and Virginia already restrict the sale of precise geolocation data. Oregon bans selling location data and information about kids under 16. Maryland's privacy law goes the furthest so far, banning the sale of sensitive data outright, similar to what New Jersey just passed. Massachusetts is reportedly considering similar legislation.
In other words: lawmakers are catching up to something people in the data-freeze and identity-protection world have been saying for years — the data broker industry has been operating with very little accountability, and the businesses buying, selling, and reselling your information often aren't ones you've ever heard of, let alone agreed to work with.
Why This Still Doesn't Cover You (Even in New Jersey)
Here's the catch: even the strongest state data broker law only reaches companies with a legal presence or activity tied to that state, and enforcement — let alone the registry itself — is still more than a year away. If you don't live in New Jersey, or even if you do, the companies already holding a file on you today aren't required to erase it, and most specialty reporting agencies aren't household names you'd think to contact on your own.
That's the gap a security freeze is built for right now, not in 2027. A freeze doesn't wait on legislation. It tells a specific reporting agency, today, that no one can pull your file without your say-so — and at FreezeReports.com, we go a step further: when we request a freeze on a specialty agency like LexisNexis, ChexSystems, CoreLogic Teletrack, or MicroBilt, we also request that they mail you a copy of what's actually in your file. Most people are genuinely surprised — and more than a little frustrated — to see how much information these lesser-known companies have been collecting and selling without ever asking.
A freeze protects the file going forward. The mailed copy shows you what's already there. New Jersey's law is a good sign for where things are headed, but until every state — and every data broker — is covered, doing this yourself is still the fastest way to actually close the door.
Want ongoing coverage on top of a freeze?
A freeze-and-report-copy strategy is aimed at the specialty agencies most people have never heard of. If you also want day-to-day monitoring across your three major credit bureau files — Equifax, Experian, and TransUnion — IdentityIQ is a service we recommend for that ongoing layer.