New Jersey Enacts Kids Code Act with Age-Appropriate Design Rules and Private Right of Action - Captain Compliance

Skip to content

Sign in

Create FREE Account

Home » Education » Compliance » New Jersey Enacts Kids Code Act with Age-Appropriate Design Rules and Private Right of Action

New Jersey Enacts Kids Code Act with Age-Appropriate Design Rules and Private Right of Action

Published<br>August 12, 2026

Table of Contents

New Jersey Governor Mikie Sherrill has signed the Kids Code Act into law, establishing an age-appropriate design framework intended to strengthen online protections for children and adolescents. The legislation imposes data minimization obligations, limits on targeted advertising, and a range of design and privacy requirements on covered online services. It is scheduled to take effect on September 1, 2027.

The law applies to organizations that either generate more than $25 million in annual revenue or process the personal data of at least 25,000 consumers per year. Covered entities will face new expectations around how they design digital products used by minors, how they handle young users’ data, and what advertising practices are permitted.

Core Requirements of the NJ Kids Code Act

The statute draws on age-appropriate design principles that have influenced similar laws in other jurisdictions. Key elements include:

Strong default privacy settings for users under 18, reducing the amount of personal data collected or shared by default.

Data minimization obligations that limit the collection and retention of minors’ personal information to what is necessary for the service.

Restrictions on targeted advertising directed at children and teens.

Age verification data restrictions that constrain how information collected for age-assurance purposes may be used or retained.

Design duties aimed at reducing risks of harm associated with online services used by younger audiences.

One of the more distinctive features is a private right of action available to individuals under age 18. This provision allows eligible individuals (or those acting on their behalf) to bring claims for violations, adding a layer of enforcement beyond government action alone.

Who Must Comply

Coverage turns on two alternative thresholds: annual revenue exceeding $25 million, or processing the personal data of 25,000 or more consumers in a year. Organizations that meet either criterion and operate online services likely to be accessed by minors in New Jersey will need to assess how the law’s design, data, and advertising rules apply to their products.

The dual threshold means both large platforms and smaller but high-volume data processors may fall within scope. Companies that previously structured compliance programs around federal children’s privacy rules or other state laws will need to map the New Jersey requirements against existing controls, particularly around default settings, advertising practices, and age-related data handling.

There is also a NJDPA which is the states comprehensive data privacy act that we have covered in depth which is also different than Daniels Law that we have also covered. If you need help with a broad reach of all the New Jersey privacy laws we are glad to help with a privacy audit.

Private Right of Action and Enforcement Implications

The inclusion of a private right of action for individuals under 18 is significant. Many state privacy and children’s online safety laws rely primarily on attorney general enforcement. By creating a pathway for private claims, New Jersey increases the potential litigation exposure for covered entities that fail to meet the statute’s standards.

Organizations should anticipate that plaintiffs’ counsel will examine product design choices, default privacy configurations, advertising practices directed at younger users, and the handling of data collected for age assurance. Documentation of risk assessments, design decisions, and data minimization practices may become important both for compliance and for defense.

Timeline and Preparation

With an effective date of September 1, 2027, covered organizations have a multi-year runway to adapt. That period should be used to:

Identify services and features likely to be accessed by users under 18 in New Jersey.

Review and, where necessary, redesign default privacy settings for younger users.

Evaluate data collection and retention practices against minimization expectations.

Assess advertising and profiling activities involving minors.

Examine age verification or age assurance processes and the subsequent use of any data collected for those purposes.

Update internal policies, product development processes, and vendor agreements to reflect the new obligations.

Because the law combines design duties, data restrictions, advertising limits, and a private right of action, compliance will require coordination among legal, privacy, product, engineering, and marketing teams rather than a purely legal or...