Fellow privacy nerds, farewell.
After 100 (hopefully) adorkable dispatches, the Data Privacy Roundup is dropping its last mic. This is the final edition, and it’s been a pleasure to ad serve you. But don’t worry. We’ll still be covering privacy on our website, just not here.
Stay tuned for a new AI-themed newsletter coming soon. Details TBD, but you can bet it’ll be full of puns, sharp analysis and probably more puns.
In the meantime, publishers, you’re going to want to read this.
Although you might not think of yourself as a data broker, in the great state of New Jersey, that’s not really your call anymore.
State of play
Publishers typically have a direct relationship with their audience and get consent before they collect data. There’s no reason for them to think that a data broker law would pertain to them.
But New Jersey’s data broker law – which was introduced and passed over the course of just two days in June and took effect immediately – is unlike every other state data broker law on the books. Most go after the middlemen, as in companies that buy and sell data about people they’ve never dealt with directly, whereas New Jersey is going after the source.
The NJ law introduces a new category called “data collector,” which is defined as a company that collects data directly from consumers and then sells or licenses that data onward – and the bar to qualify is pretty low.
“There’s no minimum thresholds,” said Jodi Daniels, CEO of data privacy consulting firm Red Clover Advisors.
If you sell or license reader data to even one broker, that’ll do it, and “sale,” Daniels said, is defined broadly enough to capture “many routine ad tech arrangements” even when money isn’t changing hands.
Because being in scope isn’t just about what you do; it’s about who you do it with.
If you share data with a company that qualifies as a data broker under the law, you’re classified as a data collector and that makes you subject.
The problem is that publishers often don’t have a clear picture of what their downstream data partners are actually doing, which makes it hard to know whether any given relationship puts them in scope, said Celine Guillou, special counsel at Kelley Drye.
“Simply proclaiming ‘We only use first-party data’ is no longer an option,” Guillou said. “The real question is how data moves through the publisher’s ecosystem.”
Companies that qualify are required to register with the state by April 2027, and their information will appear on a public registry, including name, address, website, privacy policy and any relevant opt-out information.
Then come the fees, which are tiered based on the number of New Jersey consumers whose personal data is sold or licensed – and it can get pretty steep.
The annual fee starts at $5,000 for companies that sell the personal data of 100,000 or fewer New Jersey consumers, and it rises to $1.5 million when the number of consumers exceeds 4.5 million, said Daniel Rosenzweig, founder and principal attorney at DBR Tech Law.
Surprise, you’re a data broker
Most publishers probably don’t have “NJ data broker registry fee” as a line item in their annual budget, and they’ll feel that pinch if they don’t plan.
Regardless, though, what publisher can afford to earmark $1.5 million – or even tens of thousands of dollars – a year just to satisfy the state of New Jersey?
But “the exposure is not just financial,” according to Rosenzweig. The optics are uncomfortable in a specific way.
“There is also a reputational consideration, because qualifying publishers would appear on a public registry,” he said. “And consumers may not appreciate the distinction between a ‘data collector’ and a ‘data broker.’”
But neither, most likely, do publishers themselves.
The unique “data collector” provision is “going to catch a lot of companies by surprise,” Daniels said. Most pubs probably don’t even realize that any of this applies to them, she said, because the term “data broker” conjures a different type of company entirely.
What to do?
But perception is not the reality in this case, and the April 2027 deadline is closer than it seems.
The first thing publishers should do to prepare is understand what data they’re actually collecting on their website and how it flows, including examining their data resolution practices, audience onboarding, enrichment, licensing models – all of it.
And don’t do a halfway job.
“A data inventory is essential, [and] it takes time and needs to be updated regularly,” Daniels said. “So many companies start this, don’t finish or don’t update it. Each new pixel that is added should be reviewed for this impact.”
And, hey, that process might just lead to some very belated (or perhaps very early?) spring cleaning. Once publishers have a clearer picture of their exposure, the math might not add up.
“Publishers may reconsider some arrangements,” Guillou said, “especially if the value generated by those arrangements is outweighed by the registration fees as well as the compliance burdens and downstream obligations.”
In other words, the middlemen might not be worth the squeeze, so to speak.
What exit?
There is, however, one important caveat here, although it offers publishers more uncertainty than relief.
In July, a senior official in Gov. Mikie Sherrill’s administration, speaking anonymously, told the New Jersey Globe that the state plans to suspend enforcement until the legislature fixes certain flaws with the law, including, for example, the fact that there’s no exemption for political campaigns and voter targeting data.
That said, the state Division of Consumer Affairs confirmed in an alert on its site that registration opens on April 1, 2027, with guidance to follow. Also, the sensitive data ban encoded in the statute, which prohibits the sale or licensing of health information, precise geolocation, biometric data and other sensitive categories of data, took effect the day the law was signed on June 30 and remains in place regardless of any legislative fixes to come.
Which is why it doesn’t pay to play the waiting game.
“Publishers are probably better served by evaluating their data flows and assessing their exposure,” Guillou said, “than by assuming the law will be narrowed or struck down.”
🙏 Thanks for reading all these years! For those who want a trip down memory lane, here’s the link to our very first issue from February 21, 2023. As always and still, feel free to drop me a line at allison@adexchanger.com with any comments or feedback. Bye for meow!
