New York, New Jersey, and Connecticut: how privacy law compares (2026)

Three states, three different sets of rights

New York, New Jersey, and Connecticut sit next to each other on the map, but if you live in one and work in another — or just want to know what you can actually demand from the companies holding your data — the law changes completely at each border. New Jersey and Connecticut both passed comprehensive privacy laws. New York hasn't.

That gap matters more than it sounds like it should. It's the difference between having a legal right to tell a company "delete my data" and having no lever at all beyond hoping a broker's opt-out form works.

New Jersey: broad coverage, no broker registry yet

The New Jersey Data Privacy Act took effect January 15, 2025, and it covers more companies than most state laws — it applies to any business handling 100,000+ New Jersey residents' data, or as few as 25,000 if the company sells data or gets paid for it. There's no revenue floor, which is unusually broad.

New Jersey residents can request access, correction, deletion, and portability, and can opt out of having their data sold, used for targeted ads, or run through profiling. Since roughly mid-2025, businesses have had to honor the Global Privacy Control browser signal automatically — you don't have to ask site by site.

What New Jersey doesn't have is a data-broker registry. Instead, it leans on a separate law — Daniel's Law — that gives judges, prosecutors, and law enforcement officers (and their immediate families) a strong right to demand brokers take down their home address and phone number specifically. For everyone else, requests go directly to the companies holding the data, and complaints go to the state's Division of Consumer Affairs.

See New Jersey's full privacy-rights breakdown →

Connecticut: the state actually building a broker registry

Connecticut's privacy law (CTDPA) has been active since July 2023, and it's evolved fastest of the three. As of 2026, Connecticut is one of only five states requiring data brokers to register — and one of only two (after California) building a centralized deletion tool that's supposed to let you clear your data from every registered broker in one request.

That deletion tool isn't live yet. The law phases in over several years: broker registration starts in 2027, the actual deletion mechanism isn't required until mid-2028, and brokers won't be required to process it until late 2028. Until then, Connecticut residents work the same way New Jersey residents do — requests go to individual companies, enforcement sits with the state Attorney General, and there's no ability to sue a company directly.

The thresholds are also getting broader. Starting mid-2026, the law will cover companies handling as few as 35,000 residents' data — down from 100,000 — closing a gap that let smaller data brokers sit outside the law.

See Connecticut's full privacy-rights breakdown →

New York: no comprehensive law, so the rights above don't apply

This is the real gap. New York has never passed a general consumer privacy law. What it has instead: the SHIELD Act, which requires companies to use reasonable data security and tell you if there's a breach, and a newer law protecting minors' data. Neither one gives you the right to ask a company what data it has on you, correct it, or make it stop selling your information — the rights New Jersey and Connecticut residents have by default.

In practice, that means a New York resident's ability to get their information out of a people-search site or data broker depends entirely on that specific broker's own opt-out process — not a state right that backs it up. New York residents can still submit requests to brokers that are covered by California's law (many are, since brokers rarely limit compliance by state) and can send the Global Privacy Control signal — it just isn't backed by a New York law requiring anyone to honor it.

See New York's full privacy-rights breakdown →

What this actually means if you live in the tri-state area

If you're in New Jersey or Connecticut, you have a real legal right to ask a company to stop selling your data or delete it outright — worth using, and worth knowing has teeth (New Jersey's Attorney General has already sent enforcement notices). If you're in New York, that right doesn't exist yet, so getting your information off a broker's site comes down to whatever process that broker offers.

Either way, state law only reaches the businesses it covers — and most data brokers list you regardless of what state you live in, because they operate everywhere. Filing an opt-out with one broker doesn't touch the next fifty. That's the part no state law fixes: our broker removal guides walk through the opt-out process for the sites most likely to be listing you today, state law or not.