The New Jersey Kids Code Act (A4015) codifies an age-appropriate design code, requiring covered online service providers to build products with minors’ privacy and safety as the default rather than as an opt-in. Governor Mikie Sherrill signed it on August 11, 2026 as part of a three-bill Kids’ Online Safety Package. It takes effect on the first day of the thirteenth month after enactment, which is September 1, 2027.
Who the Kids Code Act Covers
The act applies to entities that own, operate, or control an online service, do business in New Jersey, and meet at least one threshold: annual gross revenue above twenty-five million dollars, or the processing of personal data for at least twenty-five thousand consumers or households in a year. The service must also be reasonably likely to be accessed by a child under 13 or a minor aged 13 to 17, determined by its status under the federal Children’s Online Privacy Protection Act or by a documented audience composition of at least two percent. Direct messaging only services, telecommunications and broadband providers, email services, and sales of physical devices are excluded.
What the Law Requires
Covered providers must set the most protective privacy configuration as the default for minor accounts. That includes disabling geolocation sharing, blocking search engine indexing of minor profiles, hiding interaction counts, and restricting adult access to a minor’s account unless the adult is a parent or the minor grants permission. Providers must supply accessible reporting and deletion mechanisms, with ten business days to unpublish an account and forty-five days to delete it permanently, and must restrict notifications during school and overnight hours.
The act also prohibits dark patterns and compulsive design features, bars providers from prompting a minor to weaken privacy settings, restricts advertising of harmful products to minors, and forbids using a minor’s personal data beyond the purpose for which it was collected.
Penalties and Enforcement
A violation is an unlawful practice under the New Jersey Consumer Fraud Act, which the Attorney General may investigate and sue over. The act additionally creates a private right of action allowing an injured minor, a parent, or the Attorney General to recover five thousand dollars per violation or treble damages, whichever is greater, plus punitive damages for knowing or reckless violations, injunctive relief, and attorney fees.
What Businesses Should Do
Any business running a website, app, or platform that a meaningful share of teenagers use should start by measuring its actual audience composition against the two percent test, because that measurement decides whether the act applies at all. Providers that clear a threshold have until September 1, 2027 to audit default settings, notification timing, retention practices, and any engagement mechanic that could read as a compulsive design feature.
Source: New Jersey Legislature: Bill A4015. Signing confirmed by the Office of the Governor of New Jersey.
Report a violation: If you believe a business is violating this law, you can file a complaint with the New Jersey Division of Consumer Affairs.
