56:8-166.11 Consumer, authorized agent, opting out, processing, sale, personal data.

511 words·~2 min read·/nj/title-56/chapter-8/56-8-166-11·

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

8. a. A consumer may designate another person to serve as the consumer's authorized agent and act on the consumer's behalf to opt out of the processing and sale of the consumer's personal data. A consumer may designate an authorized agent using technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the collection and processing for the purpose of any sale of data or for the purpose of targeted advertising or, when such technology exists, for profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

A controller shall comply with an opt-out request received from an authorized agent under this subsection if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf.

(1)Beginning not later than six months following the effective date of P.L.2023, c.266 (C.56:8-166.4 et seq.), a controller that processes personal data for purposes of targeted advertising, or the sale of personal data shall allow consumers to exercise the right to opt out of such processing through a user-selected universal opt-out mechanism.

(2)The platform, technology, or mechanism shall:

(a)not permit its manufacturer to unfairly disadvantage another controller;

(b)not make use of a default setting that opts in a consumer to the processing or sale of personal data, unless the controller has determined that the consumer has selected such default setting and the selection clearly represents the consumer's affirmative, freely given, and unambiguous choice to opt into any processing of such consumer's personal data pursuant to P.L.2023, c.266 (C.56:8-166.4 et seq.);

(c)be consumer-friendly, clearly described, and easy to use by the average consumer;

(d)be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or state law or regulation; and

(e)enable the controller to accurately determine whether the consumer is a resident of this State and whether the consumer has made a legitimate request to opt out of the processing of personal data for the purposes of any sale of such consumer's personal data or targeted advertising.

c. The Division of Consumer Affairs in the Department of Law and Public Safety may adopt rules and regulations that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data pursuant to P.L.2023, c.266 (C.56:8-166.4 et seq.), including regulations that permit the controller to accurately authenticate the consumer as a resident of this state and determine that the mechanism represents a legitimate request to opt out of the processing of personal data pursuant to P.L.2023, c.266 (C.56:8-166.4 et seq.).

The division may update the rules that detail the technical specifications for the mechanisms from time to time to reflect the means by which consumers interact with controllers.

L.2023, c.266, s.8.