WeVote
Log In

Bill

Bill

S 4109

Prohibits controller of commercial Internet website or online service from selling sensitive personal data.

2026-2027 Regular Session Introduced by Raj Mukherji

Prohibits the controller of a commercial website or online service in New Jersey from selling sensitive personal data.

Combined with S2316 (SCS)
0
WeVote Research Nonpartisan
Bill Summary · S 4109

Summary of New Jersey Bill S 4109 (Session 222)

Overview

  • Title: Prohibits controller of commercial Internet website or online service from selling sensitive personal data
  • Jurisdiction: New Jersey
  • Session: 222
  • Introduced: May 4, 2026
  • Committee: Referred to the Senate Commerce Committee
  • Sponsor: Co-sponsor Raj Mukherji

Purpose and Intent

The bill aims to restrict the handling of sensitive personal data by the operators (controllers) of commercial internet websites and online services. Specifically, it prohibits the sale of sensitive personal data by the controller of such platforms. The underlying goal is to protect individuals’ privacy by limiting how platforms can monetize or transfer highly sensitive information.

Key Provisions (as described by the bill title and standard legislative framing)

  • Prohibition on Sale of Sensitive Data: A principal provision would prevent the controller of a commercial internet website or online service from selling sensitive personal data. “Sensitive personal data” typically encompasses information such as health data, financial information, biometric data, sexual orientation, gender identity, race/ethnicity, and other data that could cause substantial harm or distress if disclosed, though the exact statutory definition would be specified within the bill's text.
  • Scope of Application: Applies to controllers of commercial websites and online services operating in New Jersey or collecting data from New Jersey residents, depending on the bill’s statutory language regarding in-state application and extraterritorial reach.
  • Definitions and Roles: Clarifies who qualifies as the “controller” of a website or online service for purposes of the prohibition, aligning with common privacy law terminology (as contrasted with “processor,” “service provider,” etc.).

Who Is Affected

  • Affected Entities: Operators/controllers of commercial internet websites and online services that collect personal data from users.
  • Users/Residents: Individuals whose sensitive personal data is collected by such platforms would gain greater protection against sale of their data.
  • Potential Stakeholders: Online platforms, digital advertisers, data brokers, and any third parties that typically purchase or monetize sensitive data may face reduced opportunities to acquire or use such data.

Procedural and Timeline Aspects

  • Status: Introduced and referred to the Senate Commerce Committee (as of the action history dated May 4, 2026).
  • Next Steps: If advanced by the committee, the bill would move through standard Senate proceedings (potential hearings, amendments, floor vote) and would need to pass both chambers of the New Jersey Legislature and be signed by the Governor to become law.
  • Effective Date: The text provided does not specify an effective date. If enacted, the bill would typically include an effective date for compliance (e.g., upon enactment or after a set period).

Potential Impacts and Considerations

  • Privacy Protection: Strengthens protections for residents by limiting the monetization pathway (sale) for sensitive data.
  • Compliance Requirements: Platforms would need to review data sale practices, update privacy notices, and potentially implement data governance measures to ensure they do not sell sensitive data.
  • Enforcement and Penalties: The bill’s enforcement mechanisms (e.g., penalties, civil actions, or regulatory authority) would be defined in the full text; readers should examine sections detailing violations, remedies, and enforcement agencies.
  • Business Model Implications: Digital advertising and data brokerage practices that rely on selling sensitive data may be curtailed, prompting reassessment of revenue strategies.

Notes

  • This summary reflects the bill’s title and stated purpose. For precise definitions (e.g., what constitutes “sensitive personal data”), scope, exemptions, penalties, and enforcement provisions, the full bill text should be consulted once available.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.