NJ S4684

Requires businesses operating in New Jersey that collect consumer health data to maintain and publish a privacy policy disclosing categories of data collected, purposes for collection, and third parties with whom data is shared

Mandates that regulated entities obtain explicit, opt-in consent before collecting or sharing consumer health data, with separate authorization required for selling such data; sales authorizations must expire within one year and include specific disclosures

Grants consumers the right to confirm what health data is being collected about them, withdraw consent, request deletion of their data, and receive a list of all third parties who received their information

Prohibits implementing geofences within 2,000 feet of healthcare facilities to track consumers, collect health data, or send health-related advertisements to patients

Exempts HIPAA-covered entities, financial institutions subject to Gramm-Leach-Bliley Act, government agencies, nonprofits, and higher education institutions from the law's requirements; violations constitute unlawful practices under the Consumer Fraud Act