Exemptions Abound in New Jersey’s New Consumer Privacy Bill

You may be feeling overwhelmed with the thought of having to comply with yet another state privacy law. However, New Jersey's privacy bill is chock-full of significant exemptions that may ease your organization's compliance burden.

On January 8, 2024, New Jersey became the latest state to adopt comprehensive consumer data privacy legislation by passing S332. If signed into law, S332 would take effect one year from the date of enactment. The law borrows heavily from the Washington Privacy Act.

There are several similarities between New Jersey's law and other state privacy laws. We discuss these toward the end of the alert. More interesting, though, are the many useful exemptions that the bill provides. Personal data being used for the purposes outlined in these exemptions are not subject to the obligations and restrictions contained in the bill:

• The bill does not restrict a company's ability to conduct internal research using personal data to develop or improve products, services, or technology. So, personal data used to build products and services is outside the scope of the bill.
• Personal data used to perform internal operations “reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship…” is also outside of the scope of the bill. Consumer expectations can often be shaped through privacy policies, terms of use, and just-in-time notices.
• Restrictions on targeted advertising are limited to those activities displaying ads based on a consumer's activity collected across “non-affiliated websites” (i.e., third party targeted advertising). The definition of targeted advertising does not include advertisements based on activities within a controller's own websites or applications. Opt-in consent is required for targeted advertising to known teens. The bill also requires controllers to recognize universal opt out mechanisms that enable consumers to opt-out of targeted advertising. It is also important to note that if a universal opt out mechanism can signal a consumer's choice to opt-in to targeted advertising, that opt-in signal cannot be the default setting. Put another way, no signal (opt-in or opt-out) can be set by default and signals require affirmative consumer action one way or the other.
• The bill's fraud detection exemption is broader than what has been passed in other states (e.g., under the CCPA). It goes beyond security or fraud prevention required for legal compliance and includes technical issues and protection of the operator's property.
• Insurance institutions are exempt from the bill. This helps those insurers that offer insurance lines not covered by the typical GLBA exemption.
• The bill's definition of “biometric data” does not include photos or voice recordings, provided that such data is not used to generate biometrics contained within the definition (i.e., facial templates, voiceprints, facial mapping, facial geometry, or facial templates).

Two additional differences are worth highlighting. First, enforcement actions brought within the first 18 months of the law's effectiveness are subject to a 30-day notice and cure period. Second, the bill requires data protection assessments wherever processing “presents a heightened risk of harm to a consumer.” These assessments are required, at minimum, for targeted advertising, profiling, selling personal data, and processing sensitive data.

Some similarities between this bill and comprehensive data privacy laws we are used to include: a processing threshold for applicability (100,000 state residents, or 25,000 residents if the controller sells personal data), requiring a privacy notice, providing the same consumer rights we're used to from Connecticut's law, providing additional protections for data collected from children under the age of 17, requiring data processing agreements, and enforcement by the Attorney General with no private right of action.

If the bill is signed, the Attorney General may begin to promulgate rules and regulations to implement the act. For now, we await Governor Murphy's signature.