Is New Jersey's Data Privacy Act Cure Period Still Available in 2026?

No. New Jersey's Data Privacy Act (NJDPA) cure period sunset on July 15, 2026, eighteen months after the law's January 15, 2025 effective date, so the New Jersey Division of Consumer Affairs is no longer required to give businesses a chance to fix a violation before pursuing enforcement.

What the Cure Period Used to Allow

For NJDPA's first eighteen months, a business notified of an alleged violation had 30 days to cure it and avoid a formal enforcement action, provided it also gave the state a written statement explaining the fix and any steps taken to prevent a repeat. That window was a standard feature lawmakers built into many first-generation state privacy laws, meant to let businesses catch and correct compliance gaps during the law's early rollout rather than facing immediate penalties.

Why the Sunset Date Was Built In From the Start

The 30-day cure period was never permanent — the NJDPA statute set it to expire automatically 18 months after the law's effective date. That design mirrors a pattern several other states have used: give businesses a grace period while a new law is unfamiliar, then let enforcement operate at full strength once the compliance community has had time to adjust. New Jersey's clock started January 15, 2025 and ran out July 15, 2026.

What Changed on July 16, 2026

Since that date, the Division of Consumer Affairs can pursue an enforcement action for an NJDPA violation without first offering a chance to cure it. That doesn't mean every violation now draws an immediate penalty — enforcement discretion still applies — but marketers and the businesses that run data-driven advertising in New Jersey can no longer count on an automatic fix-it window the way they could through most of the law's first year and a half.

How NJDPA's Thresholds Compare to Other States

Separately from the cure period, NJDPA is also unusual for not setting a revenue threshold. It applies to controllers that process the personal data of at least 100,000 New Jersey consumers (not counting data processed solely to complete a payment transaction), or of at least 25,000 consumers if the business derives revenue, or a price discount, from selling personal data. That consumer-count structure, without a dollar-revenue floor, means a business doesn't need large revenue to fall inside NJDPA's reach — only a large enough New Jersey audience. The same January 15, 2025 start date also set the clock on a separate deadline: controllers had until July 15, 2025 to start honoring universal opt-out signals, such as Global Privacy Control, for targeted advertising and data sales, a requirement that's now been active for well over a year.

Bottom Line

Treat any current NJDPA compliance gap as live risk, not something a courtesy cure window will cover — that safety net ended July 15, 2026. If your marketing stack processes New Jersey resident data at the 100,000-consumer (or 25,000-consumer-with-data-sales) threshold, audit opt-out handling and consent flows now rather than waiting for a notice that no longer comes with a built-in grace period.

Sources: Orrick's 2024 overview of the New Jersey Data Privacy Act's effective date and applicability thresholds, and law firm guidance confirming the NJDPA's 30-day cure period sunsets 18 months after the January 15, 2025 effective date (July 15, 2026).