If your media plan still relies on third-party sensitive personal information (SPI), the first week of July should be on your radar.
Two states — Connecticut and New Jersey — just raised the legal and financial cost of doing business the old way. And they did it in different ways. That matters for how you audit vendors, structure campaigns, and plan Q3 and Q4 audience strategy.
This isn’t abstract policy talk. It’s a direct hit on how SPI has historically moved through the ad ecosystem: collected indirectly, inferred at scale, sold through brokers, and activated with minimal consumer visibility.
What changed on July 1
Connecticut: Opt-in consent is now required to sell sensitive data
Connecticut’s amendments to the Connecticut Data Privacy Act (CTDPA), enacted via SB 1295, took effect July 1, 2026. The headline for data buyers: controllers may no longer sell a consumer’s sensitive data without obtaining that consumer’s consent.
That’s not “we disclosed it in our privacy policy and offered an opt-out.” Connecticut requires a clear, affirmative act — opt-in — before sensitive data can be sold. Separate from consent to process it.
Connecticut also expanded what counts as sensitive data, now including neural data, certain government identifiers, financial account numbers, and expanded biometric and health-related categories.
The state also requires privacy notices to disclose whether personal data is used to train large language models — the first U.S. state to mandate AI training transparency as a standalone notice requirement.
And Connecticut broadened who must comply. Businesses that process sensitive data or sell personal data may fall under CTDPA regardless of the volume thresholds that previously applied.
New Jersey: An outright ban on broker sales of sensitive data
On June 30, 2026, Governor Sherrill signed A-5328 — one of the most aggressive data broker laws in the country.
Registration fees reach $1.5 million per year for the largest data brokers and data collectors. The law covers both traditional data brokers and “data collectors” — entities with a direct consumer relationship that sell data downstream.
Most importantly: New Jersey bans the sale of sensitive personal data by covered brokers and collectors — including health, financial, biometric, geolocation, sexual orientation, immigration status, and genetic data — with penalties up to $50,000 per record.
This is stricter than Connecticut. Connecticut allows sensitive data sales with opt-in consent. New Jersey, for covered brokers, bans the sale entirely. Consent does not legalize the transaction.
