NJ A6164

Requires regulated entities conducting business in New Jersey to maintain and publish a consumer health data privacy policy disclosing categories of data collected, sources, purposes, and third parties with whom data is shared

Prohibits collection or sharing of consumer health data without explicit opt-in consent, with separate consent required for sharing versus collecting; consumers can withdraw consent and request deletion of their data at any time

Mandates that sales of consumer health data require a separate written authorization from consumers containing specific disclosures, with authorizations expiring after one year and sellers required to retain copies for six years

Bans geofencing within 2,000 feet of in-person health care facilities to prevent tracking, data collection, or targeted advertising to consumers seeking health services

Exempts HIPAA-covered entities, financial institutions subject to Gramm-Leach-Bliley Act, nonprofit organizations, government agencies, and institutions of higher education from the bill's requirements