Political campaigns, candidates, party organizations, and advocacy groups could lose access to critical voter data as early as tonight after a sweeping new state law has data providers scrambling to determine whether they can legally continue selling information used to target voters in New Jersey.
The law, signed by Gov. Mikie Sherrill on June 30, creates the nation’s most aggressive regulation of the consumer data industry, imposing annual registration fees of up to $1.5 million on certain companies that sell or license personal data and civil penalties of up to $50,000 per record for unlawful sales of sensitive data.
Political data vendors from both parties say the breadth of the legislation — and the lack of implementing regulations — has created immediate uncertainty over whether some voter files, demographic models, and targeting and microtargeting products can continue to be sold in New Jersey without risking crippling liability.
That could, at least until a fix is found, bring data-driven political campaigns to a halt. Campaign technology companies, like the BGP Van for Democrats and the GOP Data Center for Republicans, could be preparing for an immediate shutdown.
“The apocalypse is coming,” said one political consultant.
Micah Rasmussen, the director of the Rebovich Institute of New Jersey Politics at Rider University, said that losing access to crucial voter data was a reason Graham Platner cited for ending his U.S. Senate campaign in Maine.
For a political campaign, it is the equivalent of a nuclear bomb.” Rasmussen said.
Among the races that would be affected is the nationally watched, hugely competitive congressional race in New Jersey’s 7th district between two-term Republican Rep. Tom Kean, Jr. (R-Westfield) and his Democratic challenger, former U.S. Navy helicopter pilot Rebecca Bennett.
The legislation was introduced by Assemblyman Bill Moen (D-Bellmawr) on Sunday, June 28, as a revenue enhancer to balance the $60.7 billion state budget, and passed by the legislature less than 48 hours later, leaving businesses virtually no time to prepare. Republicans opposed the bill as anti-business, but lawmakers from both parties appeared to overlook its impact on political campaigns in the rush to pass it.
“For too many years to count, legislatures and governors have ignored disapproval and criticism of passing laws in the dead of night, without time to scrutinize the unintended consequences of their actions,” said Rasmussen. “Now it may have finally bitten them where it counts.”
Mop carve-out for politics
The statute does not contain an explicit exemption for political campaigns, political parties, or election-related data, nor does it expressly address voter registration records, which are generally public under New Jersey election law, subject to certain restrictions.
Whether campaign data practices fall within the law will depend on how courts and the Division of Consumer Affairs interpret the statute and any implementing regulations.
If interpreted aggressively, this law could become one of the most consequential state privacy laws affecting the political data industry, particularly companies that build and license voter files, demographic models, and targeted political audiences.
Some consumer protection bills in the past had specific carve-outs for political campaigns and advocacy groups, such as the state’s Do Not Call registry, which limited telemarketers, but Moen’s bill did not include such a provision.
Rasmussen said the current crisis “would have been completely preventable with the same carve-out for political activity that’s been written into many other laws.”
Moen believes the carve-out is implied.
“Traditionally, there has been an exemption for data used in connection with First Amendment political speech,” Moen told the New Jersey Globe. “It’s obvious in this law that we are giving the Division of Consumer Affairs the responsibility to develop rules and regulations, and I would expect them to use that period of time to ensure there are no unintended consequences in the implementation of this law.”
Moen, a Camden County Democrat, said his “work on this law has been guided by my desire to hold those bad actors, who are abusing our personal data, accountable.”
A law with unprecedented reach
Unlike other state data broker laws, New Jersey regulates not only traditional data brokers but also “data collectors”—businesses that collect information directly from consumers and then sell or license it to data brokers. The law also broadly defines a sale as the sharing or transfer of personal data for monetary or other valuable consideration.
It’s unclear whether volunteer-driven data collection or data obtained by campaigns, parties, and activists through paid canvassers are considered data collectors under the new law.
The measure reaches well beyond the commercial advertising industry.
Modern political campaigns rely heavily on commercial voter files that combine public voter registration records with demographic, consumer, and predictive information to identify likely supporters, persuadable voters, and turnout targets. Those databases are licensed to candidates, political parties, labor unions, advocacy organizations, and independent expenditure groups.
Among the law’s most consequential provisions is an outright prohibition on selling or licensing “sensitive data,” including information revealing race or ethnicity, religious beliefs, health conditions, sexual orientation, citizenship or immigration status, transgender status, genetic or biometric data, and children’s data. Violations carry civil penalties of up to $50,000 for each record sold, offered for sale, or licensed.
Many political targeting products incorporate race, ethnicity, religion, and geographic modeling, raising immediate questions about whether those products can continue to be marketed in New Jersey.
Because the law prohibits selling or licensing precise geolocation data, which is specifically defined in the statute, campaigns may not face legal obstacles to geofencing around churches, union halls, political rallies, sporting events, and polling places.
Additionally, it’s unclear how the law interfaces with data exchanges between political parties, PACs, consultants and fundraising vendors.
Even where vendors believe they ultimately qualify for an exemption or that particular data products remain lawful, the statute’s ambiguity has prompted some to consider temporarily suspending sales until regulators provide guidance, the New Jersey Globe has confirmed.
Highest fees and steepest penalties in the nation
The registration requirements are equally unprecedented.
Companies falling within the statute must pay annual fees based on the number of New Jersey residents whose personal data they sell or license. Fees begin at $5,000 for companies involving up to 100,000 consumers and rise to $1.5 million annually for companies involving more than 4.5 million New Jersey consumers. New Jersey has nearly 6.7 million registered voters.
No other state approaches those figures.
The law also authorizes civil penalties of $2,500 per day for companies that fail to register, fail to pay registration fees, or fail to update required information with the Division of Consumer Affairs. There is a lack of clarity on immediate compliance concerns.
California, long considered the nation’s most aggressive privacy regulator, charges approximately $6,000 annually for data broker registration — less than one-half of one percent of New Jersey’s highest fee. Their failure-to-register penalty is $200 per day with no cap, but California has no per-record penalty.
Democrats publicly cited Texas as an example of another state – a red state – that has a data broker law. But Texas also has a $300 registration fee and a $10,000-per-year cap on penalties, something that significantly mitigates risk for data companies.
If taken to its most absurd extreme, a data company could face a $333 billion civil penalty in New Jersey.
Critics are already characterizing the measure as much a revenue-raiser as a consumer privacy law. The revenue enhancement portion of the new law came directly from Sherrill’s office, several lawmakers and staffers told the New Jersey Globe on the condition of anonymity.
The Legislature’s nonpartisan Office of Legislative Services concluded that the measure could generate “millions or tens of millions of dollars annually” in registration fees alone, as well as additional revenue from civil penalties. The fiscal office said it could not estimate the total because it lacks information on how many companies will ultimately be required to register.
Although the Division of Consumer Affairs has until March 27, 2027, to establish a public registry for data brokers and data collectors, nearly all of the law’s substantive provisions took effect immediately.
That leaves political data companies, campaigns, and advocacy organizations facing an unusual dilemma: comply with a law whose registration system does not yet exist and whose key terms — including how companies calculate the number of covered New Jersey consumers — remain undefined.
Until regulators issue implementing rules, some political data providers may determine that the legal and financial risks of continuing to license voter targeting data in New Jersey outweigh the business opportunity, potentially disrupting campaigns already preparing for this fall’s elections.
“I don’t know how they fix this,” a lawmaker told the New Jersey Globe on the condition of anonymity. “The governor can’t call the legislature into an emergency summer session to fix a fuck-up that affects political campaigns. Those optics suck.”
Sherrill’s office and the two state party organizations did not immediately respond to a request for comment.
RELATED ARTICLES
-
October 30, 2020 -
June 15, 2020 -
May 17, 2021