New NJ law says websites must ask about using your data. Businesses, news orgs worry about lawsuits.

Companies operating in New Jersey will have to inform consumers when they are collecting their personal information online — and allow them to opt out — starting in mid-2025.

New Jersey becomes the 13th state to pass similar data privacy rules, and several other state legislatures have pending bills. But some business leaders and the state’s largest press organization say New Jersey’s new requirements go further than other states, and language in the bill may open the door to excessive litigation.

Any website that collects data from more than 100,000 people per year is now required to inform each consumer and provide an opt-out option, according to the bill, which Gov. Phil Murphy signed on Jan. 17. The threshold is lowered to 25,000 consumers a year if the website is selling personal data.

State data privacy laws have come under fierce lobbying efforts by tech companies, including Amazon, Google and Meta. The companies spent more than $50 million in 2022 on federal lobbying around issues such as privacy and competition, and a federal bill to institute similar protections stalled out in 2022 after receiving bipartisan support, Bloomberg reported last year. The tech companies have also heavily lobbied state legislators.

New Jersey’s law is considered one of the strictest in the nation, according to state Sen. Raj Mukherji, a Jersey City Democrat, who sponsored the bill in the last legislative session, when he was an assemblymember.

“It has the strongest universal opt-out mechanism of any data privacy law in the country,” Mukherji said. “And it just puts consumers back in control of their own data.”

In general, when a website complies with a state’s privacy laws, a message appears informing the user that personal data is being collected, and providing an opportunity to opt out. The data collected can range from highly personal information collected on a dating or health app to information about what a person reads, buys or subscribes to online.

New Jersey’s law goes further than other states, Mukherji said, because companies are required to explicitly ask customers to opt in before collecting data on certain types of highly sensitive information, such as biometric data gathered by a health app. But the law doesn’t specify how sites and apps must ask for permission, and instead leaves that decision up to the companies.

“This important legislation will help consumers reclaim control over their own personal data, and allow them the choice to share information that is personal to them,” Murphy said in a press release after signing the bill.

The bill was in the works for two years and then rushed to the finish line on the last day of the 2022-23 legislative session with amendments that upset the New Jersey Business and Industry Association.

“The business community supports data privacy for consumers. We just want a bill, or a law, that is going to work,” said Ray Cantor, a lobbyist with the group. “There are vague terms in the bill. There’s conflicting provisions.”

For example, Cantor said the term “financial data” is not defined in the bill, and can mean different things. He added some of the language in the New Jersey bill differs from other states on how different kinds of data must be handled, making it hard for businesses that operate nationally to make their system conform with other state laws.

Legislators removed language that dealt with litigation over privacy violations. Cantor said a company that does business across state lines could be tripped up by the differences between states’ rules, and potentially be sued for it.

“We were very comfortable in letting violations be enforced by the Office of the Attorney General,” Cantor said. “What we did not want and what we think that the bill now allows is for private attorneys to bring class action lawsuits for technical violations, and that is very concerning. It doesn’t promote data privacy. It doesn’t help anyone other than those lawyers who are bringing these types of lawsuits.”

But Mukherji said the law will indeed be enforced by the attorney general, and that the removed language would have excluded consumers from filing lawsuits related to previous privacy laws.

“We’re not going to take away consumers’ rights under other existing frameworks and make them worse off. I mean, that wasn’t fair,” Mukherji said. “So that argument is a red herring to me.”

Murphy noted the criticism from the business lobby in his signing statement.

“I understand that concerns have been raised that removing that language thereby establishes a private right of action under other laws for violations of this bill,” Murphy wrote. He added that nothing in the bill expressly establishes a right for consumers to sue, and that the attorney general would establish appropriate measures to take action against violators.

Earlier this month, the New Jersey Press Association, which represents hundreds of newspapers and other newsrooms, wrote the governor a letter asking him to veto the bill over concerns that it “captures professional newsgathering activities” — and could potentially let a person try to get a news organization to remove or change information published about them, despite First Amendment protections.

The press association sought language in the bill saying it wouldn’t apply to anyone working professionally in news media “for the purpose of gathering, procuring, transmitting, compiling, editing or disseminating news for the general public.” And it cited exemptions in other state’s laws specifically exempting journalism.

But Mukherji said there is nothing in the law that would impinge on journalism in New Jersey.

The attorney general’s office will hold public hearings before it writes the detailed regulations that determine exactly how the new law will work, a process that all bills go through, Mukherji said. The law goes into effect in January 2025, with enforcement actions beginning six months later.