Two states passed major data broker laws this year: Connecticut in May and New Jersey in June. If you live in either one, you may have seen a headline calling it “sweeping” or citing eye-popping fines. What you probably didn’t see is that these two laws do almost opposite things. Only one of them is building a way for you to get your information removed, and even that one won’t exist until 2028.
The measuring stick for both is California. Its Delete Request and Opt-out Platform, known as DROP, is already live: any California resident can send a single deletion request to every registered data broker, and since August 1, 2026, those brokers have been required to check the platform every 45 days and act on what’s in it. Connecticut and New Jersey are not there yet, and it’s worth being precise about why, because “our state passed a data broker law” and “our state has a delete button” are two different claims.
Connecticut: a real deletion platform, but not until 2028
Connecticut’s Senate Bill 4, signed by Governor Ned Lamont on May 27, 2026 (now Public Act 26-64), directs the state’s Department of Consumer Protection to build a single deletion mechanism where a consumer can submit one request to every registered data broker. That puts Connecticut in a small but growing group of states, alongside California, committing to a centralized deletion tool. (Vermont amended its own law in June to call for one too.)
But the timeline matters. Data brokers have to register with the state starting January 1, 2027. The deletion mechanism itself has to exist by July 1, 2028, and registered brokers don’t have to start checking it and processing requests until October 1, 2028 (Proskauer, Hunton).
One piece arrives much sooner: starting October 1, 2026, Connecticut bans the sale of consumers’ precise geolocation data. And for data brokers that break the registration and deletion rules, the state can impose civil penalties of up to $200 per day, per consumer. All real, all enforceable on their own timelines. But the part that would let a Connecticut resident ask every broker to delete their listing at once isn’t due until mid-2028.
New Jersey: steep fines, no delete button at all
New Jersey’s law (A.5328), signed by Governor Mikie Sherrill on June 30, 2026, is a different kind of law entirely. It was introduced and passed within days, and it took effect immediately, apart from the state registry. It requires both data brokers and “data collectors” (businesses that have a direct relationship with you and then sell your data on to brokers) to register annually with the state’s Division of Consumer Affairs. Fees run from $5,000 up to $1.5 million a year depending on how many New Jersey residents’ data a company sells or licenses, which is far higher than fees under other states’ laws.
The part with real teeth kicked in immediately: since June 30, selling sensitive personal data in New Jersey is prohibited, with no exception even if the consumer agreed to the sale. The ban applies to businesses of any size, with limited exemptions such as entities already covered by federal health-privacy (HIPAA) and financial-privacy (GLBA) rules. For data brokers and data collectors, a violation carries a civil penalty of $50,000 per record (Future of Privacy Forum, Hunton).
The registration side is slower. The state registry can’t begin operating until March 27, 2027 (270 days after the law was signed), and the Division of Consumer Affairs has said it expects registration to run from April to June 2027 (Ogletree). Once the registry is open, failing to register carries a penalty of $2,500 per day.
Here’s the honest part: nothing in New Jersey’s law creates a state deletion platform like California’s. It’s a registration-and-restriction law, aimed at what brokers are allowed to sell and how transparent they have to be, not a tool that lets you ask every broker to erase your listing in one request. There is one small upside. Registrants will have to disclose in their public registration what opt-outs they offer and whether consumers can delete their data, so once the registry opens, it should become a useful map of where to send requests.
What this actually means if you live in either state
If you’re in Connecticut, the sale of your precise location data becomes illegal on October 1, 2026, broker registration begins in January 2027, and a real deletion platform is coming, but not until 2028. If you’re in New Jersey, selling your sensitive data just got a lot riskier for brokers, which is a genuine, immediate win, but there is no new mechanism for you to request removal.
That gap is why I don’t tell people to wait on legislation. A law that restricts what brokers can sell going forward doesn’t touch what’s already listed about you today, and a deletion platform that doesn’t exist yet can’t help you this year.
If you want to see where your information is listed right now, ScrubTrace offers a free scan: tell me your name and state, and I’ll look up where your information appears and email you what I find. I can’t promise removal from every broker, and I won’t pretend one company can substitute for the state platforms that are coming. I just don’t think anyone should sit on their hands until 2028 waiting for one to arrive.
Sources
Connecticut
- Connecticut Public Act 26-64 (Senate Bill 4), full text
- Proskauer on Privacy: “From Data Brokers to DNA: Connecticut Enacts Sweeping Privacy Amendments”
- Hunton Andrews Kurth: “Connecticut Privacy Law Updates: Data Broker Rules, Geolocation Sale Ban…”
New Jersey
- New Jersey A5328, full text
- Future of Privacy Forum: “Data Brokers & Beyond: Navigating New Jersey’s Data Broker & ‘Data Collector’ Registration Law”
- Hunton Andrews Kurth: “New Jersey Adopts New Data Broker Registration Regime…”
- Faegre Drinker: “New Jersey Enacts Sweeping Data Broker and Data Collector Registration Law”
- Ogletree Deakins: “New Jersey Bans Sale of Sensitive Data and Creates Public Registry for Data Brokers and Collectors”
Leave a Reply