New Jersey Kids Code Act (New Jersey Age-Appropriate Design Code)

NJ Kids Code

Children · Location · Other

Signed August 11, 2026 and effective September 1, 2027, the Kids Code requires social-media-type services that know a user is under 18 to set the highest privacy defaults, block unsolicited adult contact, hide location, limit data use and algorithmic feeds, and restrict engagement-driving design such as infinite scroll, autoplay, streaks, and night-time or school-hours notifications. Violations are consumer fraud and give injured minors a private right of action.

Where: New Jersey
Citation: A4015 (3R ACS)/S3413, 222nd Legislature (2026), supplementing Title 56 (N.J.S.A. section numbers and P.L.2026 chapter number not yet assigned online)
Status: Enacted, not yet in force
In force since: 2027-09-01
Enforced by: New Jersey Attorney General (Consumer Fraud Act powers and rulemaking); Commissioner of Health may add compulsive-use criteria; private actions by injured minors or their parents
People can sue: Yes
Penalties: A violation is an unlawful practice under the Consumer Fraud Act (CFA civil penalties of up to $10,000 first / $20,000 subsequent under 56:8-13). An injured child or minor (or a parent or the Attorney General on their behalf) may recover, for negligent or worse violations, the greater of $5,000 per violation or treble damages, punitive damages for reckless or knowing violations, injunctive and declaratory relief, and attorney's fees; any violation of sections 4 to 12 counts as an injury (s.14).
Applies to: Covered online service providers: entities doing business in New Jersey that own, operate, or provide an online service reasonably likely to be accessed by minors and that either have annual gross revenue above $25 million (CPI-adjusted every two years from 2029) or process personal data of at least 25,000 consumers or households a year, plus commonly branded affiliates (s.3)
'Online service' means a public Internet service displaying account-holder content where interacting with other users' content is a central feature (social-media-type services); telecom, broadband, email, and physical products are excluded, as are entities that only provide direct messaging (s.3)
Obligations run to users the provider has actual knowledge are under 13 (covered child) or 13 to 17 (covered minor); actual knowledge includes declared age, age flags, and any age the provider infers for marketing or other purposes (s.3)
Government entities and GLBA, HITECH/HIPAA, and human-subjects research data are exempt (s.15)

What a privacy notice must say

Give a prominent, constant real-time signal to a minor when precise geolocation is being collected or used or when anyone, including a parent, is monitoring their activity.A4015 3R, s.11 · From 2027-09-01

Rights it gives people

Let minors and parents set recommendation preferences and access, review, and change the personal data used by the recommendation system.A4015 3R, s.10 · Only if: Providers using an algorithmic recommendation system · From 2027-09-01
Provide an easy mechanism (no more steps than sign-up) for minors to unpublish their account (within 10 business days) or permanently delete it (within 45 calendar days).A4015 3R, s.9 · From 2027-09-01

Practices it requires

Send no notifications to minors by default, none between 10 p.m. and 6 a.m., and none during school hours (8 a.m. to 4 p.m. on weekdays from Labor Day to Memorial Day); no dark patterns; no ads to minors for narcotics, tobacco, gambling, or alcohol.A4015 3R, s.6 · From 2027-09-01
Use a minor's personal data only for the purpose it was collected, keep only the minimum needed, and base algorithmic recommendations only on listed signals such as the minor's express requests, search queries, and chosen settings.A4015 3R, s.7 · From 2027-09-01
Set all default privacy settings for known children and minors to the highest level: hide their accounts and media from unconnected adults, block adult direct messages, hide location and connections, disable search engine indexing, and turn off interaction counts.A4015 3R, s.4(a) · From 2027-09-01
Use personal data collected for age verification for no other purpose and delete it within 15 days after verifying age.A4015 3R, s.8(b) · From 2027-09-01
Do not offer a single setting that loosens several protections at once or prompt minors to weaken privacy settings; provide settings to block specific users.A4015 3R, s.4(b)-(c) · From 2027-09-01

Other duties

Provide a prominent tool for children, minors, and parents to report harms, and take all reasonable steps so data use and covered design features do not cause compulsive use.A4015 3R, ss.5, 12 · From 2027-09-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The P.L.2026 chapter number and N.J.S.A. codification were not yet posted on the Legislature's site as of 2026-09-25; section citations refer to the passed bill text (3R). | Effective date computed as the first day of the 13th month after enactment on August 11, 2026 (September 1, 2027), consistent with press reports of a September 2027 start. | No litigation challenging the law was found, but similar design-code laws elsewhere (e.g., California) have been enjoined; watch for a challenge before the effective date.

Research reference, not legal advice.