Added by P.L.2026, c.25: a controller must not sell sensitive data, and the prohibition applies to every individual or legal entity regardless of how many consumers' data it controls or processes, so the Act's 100,000 and 25,000 consumer thresholds do not limit it. There is no consent exception in the text. A data broker (including a controller) or data collector that sells, offers for sale or licenses sensitive data in violation of this paragraph or of section 3 of the 2026 Act is liable to a civil penalty of $50,000 per record (P.L.2026, c.25, section 5). The administration said in July 2026 it would not pursue penalties under the 2026 Act while the Legislature addresses defects; the Attorney General's office said it evaluates enforcement case by case.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.