New Jersey has joined California, Maryland, and Vermont in attempting to regulate how businesses interact with children online. The law, the New Jersey Kids Code Act, was signed into law on August 11, 2026. It will go into effect on September 1, 2027, unless it is blocked or delayed. The law will apply to businesses that offer online services in New Jersey that are “reasonably likely to be accessed by a child or minor,” and that either have gross annual revenues of over $25 million or process personal data of 25,000 consumers or households.
As we discussed previously, these laws attempt to replicate the UK’s Age Appropriate Design Code. However, California and Maryland’s laws were challenged on First Amendment grounds before they went into effect. We anticipate that there may be a challenge to this New Jersey law, even though it has key differences from the already-challenged California and Maryland laws. This includes not requiring companies to guess or estimate a child’s age. It also does not impose a broad “best interest of the child” obligation when designing services. Instead, the law lists specific obligations when interacting with an individual the platform knows is under 18. These include the following:
- Covered online service providers will need to turn on the strongest privacy settings for minors, defined as those under 18, by default. This includes turning off location sharing by default and in some cases not sharing minors’ content with non-parent adults. Companies will also need to give minors a way to block other users and stop children from messaging adults who are not their parents.
- Under the law, online service providers will not be able to send notifications to minors by default. They also will not be able to send them during the school day, nor before 6am or after 10pm. They also cannot serve, or permit advertisers to serve, children with tobacco or gambling ads.
- The law will also limit how companies use minors’ data. Once in effect, covered online service providers will only be able to keep the minimum amount of minors’ data that is needed for the features the minor has chosen. They also cannot use minors’ data to target content to minors unless certain criteria are met. This includes matching parent-selected privacy settings, or with the minors’ consent.
Unlike other states, New Jersey’s law provides for a private right of action. This is in addition to giving enforcement authority to the New Jersey Attorney General. Potential remedies include $5,000 per violation or treble damages.
Putting It Into Practice: The passage of this law is a reminder that states are continuing their efforts to regulate online interactions with children. Even if the law will not be applicable to your operations when it goes into effect at the end of next year, if your company’s services are accessible to children, you may still want to keep these laws in mind when designing online platforms.