– Personal data of at least 100,000 consumers (excluding personal data processed solely for the purpose of completing a payment transaction).

– Personal data of at least 25,000 consumers and derive revenue or receive a discount on the price of any goods or services from the sale of personal data. 

The NJPA does not have a minimum revenue threshold for a business to automatically fall within its scope.

– Personal data of at least 35,000 unique consumers, excluding personal data controlled or processed solely to complete a payment transaction.

– Personal data of at least 100,000 unique consumers and derive more than 25% of their gross revenue from the sale of personal data.

The NHPA does not have a minimum revenue threshold for a business to automatically fall within its scope.

The NJPA provides entity-level exemptions for certain insurance institutions, state entities and companies subject to the Gramm-Leach-Bliley Act (GLBA), among others.

The NHPA provides entity-level exemptions for companies subject to the GLBA and HIPAA, state entities, and higher education institutions, among others.

Unlike the NJPA, the NHPA provides an exemption for companies that “comply with a statute that provides [a] greater measure of privacy protection to individuals” in the event of a conflict. 

– Targeted advertising.

– Sale of personal data.

– Profiling that produces legal or other significant effect concerning the consumer.

– Targeted advertising.

– Sale of personal data.

– Profiling that produces legal or other significant effect concerning the consumer.

– Rulemaking. The NJPA requires the Division of Consumer Affairs in the Department of Law and Public Safety to adopt rules and regulations to detail the NJPA’s specifications. To date, only the California and Colorado privacy laws provide for such rulemaking authority. The NJPA is silent as to when the rulemaking will be finalized. No time frame is currently set, which may further complicate compliance efforts – e.g., as seen by the several iterations of regulations published for the California Consumer Privacy Act (CCPA).

– Broad definition of sensitive data. The NJPA follows the CCPA’s broader definition of “sensitive data” to include financial information – a notable variation from the Colorado, Connecticut, Utah and Virginia privacy laws that are currently in effect. The NJPA’s definition of “sensitive data” includes a consumer’s account number, account login, financial account, or credit or debit card number, in combination with any required security code, access code or password that would permit access to a consumer’s financial account.

– Universal opt-out mechanisms for profiling. Except for Colorado and California, most state privacy laws currently in effect do not require the use of a universal opt-out mechanism (UOOM).  Colorado and California only require UOOM for targeted advertising and sale of personal data. But the NJPA goes further to require companies to also provide a UOOM for user profiling (i.e., decisions that produce a legal or similarly significant effect concerning a consumer, such as denial of lending services or housing). However, the NJPA’s exemptions for companies subject to the GLBA and HIPAA should limit the impact of the UOOM for user profiling.

– Payment transaction data excluded. The NJPA specifically carves out personal data processed solely for the purpose of completing a payment transaction from its purview (even though such data would typically fall within the definition of personal data).  This may alleviate some compliance burden on businesses and appears to diverge from other existing state privacy laws.

– Rulemaking. Unlike the NJPA, the NHPA’s rulemaking terms are limited to a provision that allows the New Hampshire Secretary of State’s office to adopt standards and requirements with respect to the privacy notice and secure means to exercise rights contemplated by the bill.

– Coverage thresholds. Unlike the NJPA and several other state privacy laws, the NHPA has a unique coverage threshold of 35,000 customer records (as opposed to 25,000 or 50,000).

– Payment transaction data excluded. Like the NJPA, the NHPA specifically carves out from its purview personal data processed solely for the purpose of completing a payment transaction (even though such data would typically fall within the definition of personal data).