The law applies to organizations that either generate more than $25 million in annual revenue or process the personal data of at least 25,000 consumers per year. Covered entities will face new expectations around how they design digital products used by minors, how they handle young users’ data, and what advertising practices are permitted.
Core Requirements of the NJ Kids Code Act
The statute draws on age-appropriate design principles that have influenced similar laws in other jurisdictions. Key elements include:
- Strong default privacy settings for users under 18, reducing the amount of personal data collected or shared by default.
- Data minimization obligations that limit the collection and retention of minors’ personal information to what is necessary for the service.
- Restrictions on targeted advertising directed at children and teens.
- Age verification data restrictions that constrain how information collected for age-assurance purposes may be used or retained.
- Design duties aimed at reducing risks of harm associated with online services used by younger audiences.
One of the more distinctive features is a private right of action available to individuals under age 18. This provision allows eligible individuals (or those acting on their behalf) to bring claims for violations, adding a layer of enforcement beyond government action alone.
Who Must Comply
Coverage turns on two alternative thresholds: annual revenue exceeding $25 million, or processing the personal data of 25,000 or more consumers in a year. Organizations that meet either criterion and operate online services likely to be accessed by minors in New Jersey will need to assess how the law’s design, data, and advertising rules apply to their products.
The dual threshold means both large platforms and smaller but high-volume data processors may fall within scope. Companies that previously structured compliance programs around federal children’s privacy rules or other state laws will need to map the New Jersey requirements against existing controls, particularly around default settings, advertising practices, and age-related data handling.
There is also a NJDPA which is the states comprehensive data privacy act that we have covered in depth which is also different than Daniels Law that we have also covered. If you need help with a broad reach of all the New Jersey privacy laws we are glad to help with a privacy audit.
Private Right of Action and Enforcement Implications
The inclusion of a private right of action for individuals under 18 is significant. Many state privacy and children’s online safety laws rely primarily on attorney general enforcement. By creating a pathway for private claims, New Jersey increases the potential litigation exposure for covered entities that fail to meet the statute’s standards.
Organizations should anticipate that plaintiffs’ counsel will examine product design choices, default privacy configurations, advertising practices directed at younger users, and the handling of data collected for age assurance. Documentation of risk assessments, design decisions, and data minimization practices may become important both for compliance and for defense.
Timeline and Preparation
With an effective date of September 1, 2027, covered organizations have a multi-year runway to adapt. That period should be used to:
- Identify services and features likely to be accessed by users under 18 in New Jersey.
- Review and, where necessary, redesign default privacy settings for younger users.
- Evaluate data collection and retention practices against minimization expectations.
- Assess advertising and profiling activities involving minors.
- Examine age verification or age assurance processes and the subsequent use of any data collected for those purposes.
- Update internal policies, product development processes, and vendor agreements to reflect the new obligations.
Because the law combines design duties, data restrictions, advertising limits, and a private right of action, compliance will require coordination among legal, privacy, product, engineering, and marketing teams rather than a purely legal or policy exercise.
New Jersey’s Kids Code Act Age Appropriate Design Help
Captain Compliance thats who can help with the NJ Kids Code Act for age appropriate design requirements starting next year. New Jersey’s Kids Code Act adds to a growing body of state legislation focused on children’s online safety and age-appropriate design. While approaches differ across jurisdictions, common themes include higher default privacy protections, limits on behavioral advertising to minors, constraints on data use, and heightened accountability for product design choices that affect younger users.
Organizations operating nationally will need to reconcile New Jersey’s requirements with those of other states and with existing federal frameworks such as the Children’s Online Privacy Protection Act. The combination of a relatively clear coverage threshold, concrete design and data obligations, and a private right of action makes the New Jersey statute one that warrants early attention in compliance planning.
Companies that begin mapping product features, data flows, and advertising practices against the Kids Code Act’s requirements well before the 2027 effective date will be better positioned to implement necessary changes without disrupting service or creating last-minute compliance gaps.