This article is for informational purposes only and does not constitute tax, legal, or accounting advice. Consult a qualified tax professional before making compliance decisions.

Policy

Kentucky Taxes the Data Sale. New Jersey Charges for Being the Seller. A.5328 and the AI Agent Data Pipeline

Beardsley Rumble|2026-08-03|7 min read

Kentucky's sales tax on data brokering services took effect two days ago, on August 1. New Jersey's A.5328 took effect on June 30 and reaches roughly the same industry on a completely different axis: Kentucky taxes the transaction, New Jersey charges for the status. If your agent sits anywhere in a data pipeline that touches New Jersey residents, you now have two obligations with almost nothing in common — different triggers, different math, and only one of them is a tax.

That last point is why this one gets missed. A.5328 is a consumer-protection statute administered by the Division of Consumer Affairs, not the Division of Taxation. It will not appear in a sales tax research tool, it will not be flagged by a tax engine, and it does not scale with revenue. It is a fixed annual toll priced by how many people's data you handle.

What A.5328 Does

New Jersey enacted A.5328 (P.L. 2026, c. 25) on June 30, 2026. It creates an annual registration and fee regime for two categories of business, requires a set of public disclosures, and flatly prohibits the sale or licensing of sensitive data.

The statute defines a data broker as a person or entity that knowingly collects or purchases the personal data of a consumer with whom it has no direct relationship and then sells or licenses that data to a third party. A direct relationship, per the statute, covers the consumer as a customer, client, subscriber or user, as an employee, contractor or agent, as an investor, or as a donor.

The second definition is the one that will surprise people. A data collector is a business that knowingly collects the personal data of a consumer with whom it does have a direct relationship and sells or licenses that data to a data broker. Most operators will read the first definition, conclude that their users are their users, and stop reading. The second definition is written precisely for them. Having a direct relationship with your users is not an exit from this statute; it is the entry condition for the other half of it.

"Sale" is defined broadly — sharing, disclosing, or transferring personal data for monetary or other valuable consideration — and, notably, without carrying over the exceptions that appear in New Jersey's comprehensive privacy law. "Other valuable consideration" is doing real work in that sentence. A data-for-access arrangement, a revenue-share on enriched output, or a barter of usage telemetry for discounted API pricing are all candidates.

The Fee Schedule, and Where It Breaks

Registration fees are keyed to the number of New Jersey residents whose data the registrant sells or licenses:

Up to 100,000 consumers: $5,000

100,001 to 500,000: $10,000

500,001 to 1,000,000: $100,000

1,000,001 to 1,500,000: $500,000

1,500,001 to 2,500,000: $750,000

2,500,001 to 4,500,000: $1,000,000

More than 4,500,000: $1,500,000

Published summaries differ slightly on where the band edges fall by a single record; the tier amounts are consistent across sources. That ambiguity matters more than it normally would, because of what the schedule does at the boundaries.

This is not a graduated schedule. It is a step function with two very tall steps. Crossing from 500,000 to 500,001 New Jersey consumers moves the fee from $10,000 to $100,000 — one additional record costs $90,000. Crossing from 1,000,000 to 1,000,001 moves it from $100,000 to $500,000. One record, $400,000. There is no marginal-rate smoothing, no proration, and no apparent mechanism for a mid-year correction.

The top of the schedule is worth naming plainly: because the fee caps at $1.5 million, it is regressive above 4.5 million consumers. A broker holding 45 million New Jersey-linked records pays the same $1.5 million as one holding 4.5 million — one-tenth the cost per record. The statute has been described as the nation's costliest data broker law, and in absolute terms it is. Per record, it is cheapest for the largest brokers and most expensive in the middle bands, which is exactly where a growing agent platform lands.

This Is an Economic Nexus Threshold Run Backwards

Kentucky removed its 200-transaction economic nexus prong effective August 1, and we wrote at the time that the reason was sound: counting transactions punishes low-value, high-volume sellers, which is the shape of most agent traffic. An operator clearing 200 Kentucky transactions at a penny each was registered on $2 of revenue.

New Jersey has just built the same defect on purpose, in a different statute. A.5328 counts people, not dollars. An agent platform that enriches and licenses data on 600,000 New Jersey residents pays $100,000 a year whether that book of business generates $50 million or $50,000. There is no de minimis floor either: the lowest band starts at the first New Jersey consumer, so a three-person operation licensing an enriched dataset owes $5,000 annually. For comparison, California's broker registration fee is roughly $6,000, Connecticut's $2,500, and Vermont's $100 — but those regimes reach brokers, and New Jersey's also reaches the collectors upstream of them.

This is the third form of the same underlying problem we have tracked all summer. California's S.B. 122 workshop needs to know which user or device received a digital product. Utah S.B. 287 needs to know where an impression was delivered. New Jersey needs to know how many New Jersey consumers are in your pipeline. Every one of these regimes requires attributing a machine-mediated interaction back to a specific human in a specific state, and none of them says how to do it when an agent is standing in the middle.

For agent operators the attribution question is not academic. If an AI agent transacts on behalf of a principal, the platform's direct relationship is arguably with the agent, not with the human whose data flows through it. That reading would push a platform out of "data collector" and into "data broker" — no direct relationship with the consumer — which is the more burdensome classification, not the lesser one. The statute gives no guidance on agent intermediation, and neither does anything the Division has published.

The Bigger Number Is Not the Fee

The registration fee will get the headlines. The prohibition is the larger exposure. Selling, offering for sale, or licensing sensitive data carries a penalty of up to $50,000 per record, and the sensitive-data list includes precise geolocation alongside health, financial, biometric and genetic identifiers, immigration status, and children's data. Registration failure runs $2,500 per day.

Precise geolocation is the one to sit with. Agents doing local commerce, logistics, delivery routing, or venue booking handle it as a matter of course, and the volume of records in an agent pipeline is not human-scale. A five-figure per-record penalty against a six-figure record count is not a compliance cost; it is a solvency question. Exemptions exist — HIPAA-regulated health information, GLBA and FCRA data, publicly available information for specified purposes, and third-party e-commerce platforms among them — but they are carve-outs to be qualified for, not defaults.

Practical Impact for AI Agent Operators

Do not file anything yet, and do not skip the scoping. The registry provisions are inoperative for 270 days from enactment, to roughly March 27, 2027, and the Division of Consumer Affairs announced on July 10 that the initial registration window runs April 1 through June 30, 2027. There is no action to take at the counter today. There is eight months of work to do before the counter opens.

Count your New Jersey consumers before you need the number. The fee is keyed entirely to that count, and nobody's data model currently produces it. If you cannot generate a defensible New Jersey resident count from your pipeline, you cannot pick a tier, and picking the wrong one is a $2,500-per-day problem.

Run both definitions, not just the first. Ask separately whether you sell or license data on people you have no relationship with, and whether you sell or license data on your own users to anyone who is themselves a broker. Either answer registers you. Most operators will only check the first.

Audit what counts as consideration. Because "sale" reaches other valuable consideration without the privacy law's exceptions, data-sharing arrangements that were structured specifically to avoid being sales may not survive this definition. Re-paper them on this statute's terms, not the NJDPA's.

Treat precise geolocation as a hard stop. The prohibition has no consumer-count threshold and no fee attached to it. It applies at the first record.

Build the residency attribution once. This is the same telemetry California, Utah, and now New Jersey each need in a different shape. Three deadlines, one data model.

What to Watch

Whether the Division of Consumer Affairs' implementing guidance addresses agent intermediation at all — specifically, whether a platform whose direct relationship runs to an autonomous agent rather than to the underlying human is a collector or a broker. Whether the band edges get clarified before the April 2027 window, given that a single record decides a $90,000 and a $400,000 question. And whether other states copy the headcount-fee structure now that New Jersey has demonstrated it survives enactment; Kentucky chose to tax the transaction, New Jersey chose to charge for the status, and the next state to move will pick one of those two templates. To model how your agent's transactions are sourced and taxed today, start with AI agent sales tax by state.

This analysis is for informational purposes only and does not constitute legal or tax advice. Consult a licensed tax professional for compliance decisions.