In no case may a data broker or data collector sell or license sensitive data to any other individual or entity, with the section's own exemptions for HIPAA protected health information and equivalently protected information, GLBA financial institutions and data, secondary market institutions, insurance institutions, Motor Vehicle Commission sales permitted by the DPPA, FCRA-governed consumer reporting, government bodies, human subjects research, insurance-support organisations and registered national securities associations. The penalty is $50,000 per record sold, offered for sale or licensed (section 5). The 2026 Act applies in addition to, not in lieu of, the NJDPA (section 6), and the Director is to adopt implementing rules (section 7).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.