New Jersey's data broker law creates a recurring compliance obligation that could affect your business—even if you don't think of yourself as a data broker.
Most auto service shop owners in New Jersey don't realize they might be classified as a "data broker" under a new state law—and if they are, they face a significant new compliance requirement that kicks in over the next year.
Senate Bill 4806, signed into law, requires data brokers to delete consumer personal data within 45 days of a deletion request. The law defines a data broker as any business that collects or buys consumer personal information without a direct relationship with that consumer, and then resells or licenses that data to others. For many auto service businesses, this definition may apply—particularly if you collect customer data and share it with third parties, such as insurance companies, fleet operators, or data aggregators.
Under Section 3(a) of S4806, data brokers must:
Check a state deletion portal at least every 45 days for consumer requests to delete their personal data. Delete all matching records within that 45-day window—and ensure any contractors or service providers you work with do the same. This is not a one-time task. It's a recurring obligation that repeats every 45 days, for as long as you operate.
If your business collects names, phone numbers, email addresses, vehicle information, service history, or payment details—and you share any of that data with third parties—you should assume this applies to you.
The law becomes effective on the first day of the thirteenth month following enactment. This means you have roughly a year to understand whether you qualify as a data broker, set up systems to monitor the state portal, and build a process for responding to deletion requests within the 45-day window.
Audit obligations begin three years after the law takes effect, so compliance tracking should start now, even if the formal deletion requirement hasn't kicked in yet.
If you miss the 45-day deadline, you're in violation of state law. Penalties and enforcement mechanisms are established under the statute. Beyond legal risk, failing to delete data when requested can damage customer trust—especially as privacy expectations continue to shift.
The practical challenge: you'll need to build or adopt a system that flags deletion requests, tracks them, and ensures your entire vendor network complies within the window. For shops that use multiple software platforms, third-party service providers, or cloud storage, this coordination can be complex.
What to do now: Review your data practices. Ask yourself: Do you collect customer personal information? Do you share it with insurers, fleet managers, marketing companies, or other third parties? If yes, you likely need to prepare for compliance. Document your current data flows, identify all vendors who touch customer data, and begin planning your 45-day deletion process.
The New Jersey Automobile Retailers Association and other trade groups are tracking implementation guidance as the effective date approaches. Consulting with legal counsel familiar with S4806 is advisable if your business handles significant customer data.
Source: S4806, Section 3(a), page 5; Section 8 (effective date); New Jersey Legislature.