Never mind the fact that there are at least 38 other states that require notifications. It looks like John could be in breach of the laws of more than half of the states in the Union. If you are in one of these states, read the statute applicable to your state and see if he was required to notify you even though he is setup in New Jersey. If he was setup somewhere else, he was still required to notify any NJ residents he did business with.
http://www.ncsl.org/programs/lis/cip...breachlaws.htm