Privacy & Cybersecurity Law Blog

On August 11, 2026, New Jersey Governor Mikie Sherrill's signed the New Jersey Kids Code Act (Assembly Bill 4015) (“the Act”). The Act imposes a range of privacy-by-default and safety-by-design obligations on online service providers whose services are reasonably likely to be accessed by minors.   New Jersey joins a growing list of states - including California, Maryland, Nebraska and Vermont - that have adopted age-appropriate design code legislation, modeled, in part, on the United Kingdom's Age Appropriate Design Code.

The Act takes effect on the first day of the 13th month following enactment, giving covered businesses slightly more than a year to build a compliance program.

Who Is Covered?

The Act applies to any “covered online service provider,” meaning a business that:

• owns, operates, or controls an online service (or derives the majority of its revenue from online services);
• conducts business in New Jersey;
• has an online service that is reasonably likely to be accessed by a child (those under 13) or minor (those 13 and over but under 18); and
• either (1) has annual gross revenue exceeding $25 million (to be adjusted to reflect the percentage change in the Consumer Price Index every two years beginning January 2029), or (2) annually processes the personal data of at least 25,000 consumers or households.

An “online service” is any service, product or feature provided over the Internet that collects, uses, stores, discloses, analyzes, deletes or modifies the personal data of consumers.  An online service is “reasonably likely to be accessed” by a covered child or covered minor if the services are:

• “website[s] or online service[s] directed to children” as defined by COPPA;
• determined to have at least 2% of its audience routinely accessing the service comprised of individuals between two and 17 years of age; or
• known, or should have been known, by the covered online service provider to have at least 2% of its audience include individuals two to 17 years of age.

In making the latter assessment, the covered online service provider must not collect or process any personal data not reasonably necessary to provide an online service with which a covered child or covered minor is actively and knowingly engaged.

Businesses and online services that solely provide direct messaging services or products are excluded, as are telecommunications services, broadband internet access services, email services and the sale, delivery or use of a physical device product.

The Act exempts data governed by GLBA, HIPAA, HITECH and certain human-subjects research frameworks.

What Does the Act Require?

The Act's substantive requirements focus on default settings and design practices facing users the provider has actual knowledge are a covered child or covered minor.

An online covered service provider must:

• configure default privacy settings to the most privacy-protective option, including:
  • restricting covered adult users (i.e., an individual the covered online service provider has actual knowledge is an adult) from viewing the content of, or media created or posted by, a covered child or covered minor's account, unless: (1) the adult is the child’s or minor’s parent; or (2) the covered child or covered minor unambiguously allowed the covered adult to view their account or chose to make the account public;
    • prohibiting direct messaging between a covered child or covered minor and a covered adult unless: (1) the adult is the child’s or minor’s parent; or (2) the covered child or covered minor unambiguously allowed direct messaging;
    • prohibiting the display of a covered child’s or covered minor’s location to other users unless the covered child or covered minor has expressly and unambiguously chosen to share their location with a specific user;
    • disabling search engine indexing of covered children’s and covered minors’ accounts; and
    • disabling all interaction counts (i.e., comments, reactions or reshares) and offering settings to enable or disable specific types of interaction metrics;
  • offer individual, accessible privacy settings to a covered child or covered minor that provides the option to block specific users from, at a minimum: (1) accessing or interacting with their media; and/or (2) communicating with them through any means offered by the covered online service provider, including direct messaging;
  • establish a prominent and accessible user interface to enable a covered child, covered minor, and parent of a covered child or covered minor to report harms experienced on the online service;
  • provide a prominent and accessible mechanism for a covered child or covered minor to request that their account be unpublished or permanently deleted;
    • This mechanism cannot take more steps than is required to create an account on the online service; and
    • The covered online service provider has 10 business days from submission of such request to unpublish the account and 45 calendar days from submission to permanently delete it;
  • if using an algorithmic recommendation system, establish a prominent and accessible user interface to enable a covered child, covered minor and parent of a covered child or covered minor to: (1) communicate preferences about which types of media are to be recommended or blocked; and (2) access, review and make changes to any personal data the covered online service provider uses to determine the output;
  • provide a prominent and constant real-time signal to a covered child or covered minor when precise geolocation information is being collected or used; and
  • take all reasonable steps to ensure that the covered online service provider’s use of a covered child’s or covered minor’s personal data and the design of a covered design feature do not result in compulsive use.

A covered online service provider is prohibited from, among other things:

• offering a single setting that makes multiple default privacy settings less protective at once;
• prompting any covered child or covered minor to lower their privacy settings, unless the change is necessary to access a service or feature that a covered child, covered minor or parent of a covered child has expressly and unambiguously requested;
• sending notifications to any covered child or covered minor by default or sending notifications to a covered child or covered minor between 10:00 p.m. and 6:00 a.m. and, on a weekday between Labor Day and Memorial Day, between 8:00 a.m. and 4:00 p.m.;
• targeting, or allowing an advertiser to target, an advertisement to a covered child or covered minor for narcotic drugs, tobacco products, gambling or alcohol;
• using dark patterns in regard to a covered child or covered minor; or
• using the personal data of a covered child or covered minor for any reason other than the reason for which the personal data was collected, including to verify the user’s age or select, recommend or prioritize media using an algorithmic recommendation system unless certain circumstances are met.

How Will the Act Be Enforced?

A violation of the Act is deemed an unlawful practice under the New Jersey Consumer Fraud Act, giving the Attorney General authority to investigate and bring civil actions.

The Act also creates a private right of action. A covered child or covered minor injured by a violation,  or the Attorney General or a parent acting on the child or minor's behalf, may bring a civil action for any negligent or greater violation of the Act, a court may award a prevailing plaintiffs, as appropriate: $5,000 per violation or treble damages (whichever is greater), punitive damages for reckless or knowing violations, injunctive or declaratory relief, and attorneys' fees and costs.