Notwithstanding any State law, rule, regulation, or order to the contrary, the provisions of P.L. 2023, c. 266 (C.56:8-166.4 et seq.) shall only apply to controllers that conduct business in the State or produce products or services that are targeted to residents of the State, and that during a calendar year either:
a. control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction; orb. control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data.Added by L. 2023, c. 266, s. 2, eff. 1/15/2025.