New Jersey Kids Code Act

Overview

The New Jersey Age-Appropriate Design Code, also known as the New Jersey Kids Code Act, represents a significant legislative effort to enhance online privacy and safety for minors within the state. Introduced as Assembly Bill A4015, this Act mandates that covered online service providers implement specific measures to protect children and minors from potential harms associated with digital platforms. The legislation acknowledges a growing youth mental health crisis and aims to create a safer online environment by shifting the responsibility for child safety from parents and children to the online service providers themselves. It seeks to achieve this by requiring age-appropriate design features, robust privacy settings by default, and limitations on data collection and use for individuals under 18 years of age.

The Act's foundational premise is that online services likely to be accessed by children should be designed with the distinct needs of young people in mind, preventing risks such as sexual exploitation, abuse, discrimination, financial harm, or physical harm. It builds upon recommendations from the New Jersey Commission on the Effects of Social Media Usage on Adolescents, which in its 2025 report, called for stronger privacy protections, increased research into social media's effects, and actions against addictive platform features. The bill specifically targets design features that may lead to compulsive use among minors, requiring providers to take reasonable steps to mitigate such outcomes. Furthermore, it prohibits the use of 'dark patterns'—user interfaces designed to subvert user autonomy or decision-making—in a manner that could harm minors.

Definitions

The New Jersey Age-Appropriate Design Code establishes several key definitions to delineate its scope and applicability. A 'covered online service provider' is central to the Act, referring to any online service, product, or feature that is reasonably likely to be accessed by a child or minor. This broad definition ensures that a wide range of digital platforms falls under the purview of the legislation, including those that do not explicitly target minors but whose audience includes a significant percentage of individuals aged two through seventeen. The Act defines 'minor' as an individual who is at least 13 years of age but less than 18 years of age, and 'child' as an individual under 13 years of age, with different protections sometimes applying based on these age groups.

'Personal data' is defined comprehensively, encompassing any information that is linked or reasonably linkable to an identified or identifiable individual, including sensitive personal data such as genetic or biometric data, precise geolocation data, and personal data collected from a known child. The Act also introduces the concept of 'dark pattern,' aligning with the United States Federal Trade Commission's understanding of user interfaces designed to subvert or impair user autonomy, decision-making, or choice. Crucially, 'compulsive use' is addressed, requiring online service providers to take reasonable steps to ensure that their use of a minor's personal data and the design of covered features do not result in such use. These definitions are critical for understanding the obligations placed on online service providers and the rights afforded to minors under the Act.

Governance and Institutional Framework

The implementation and enforcement of the New Jersey Age-Appropriate Design Code primarily fall under the jurisdiction of the Office of the Attorney General within the Department of Law and Public Safety. This agency is empowered to adopt rules and regulations necessary to implement the provisions of the bill, ensuring that online service providers comply with the new standards for minor protection. The Attorney General's office is also responsible for investigating potential violations and bringing civil actions against non-compliant entities. This centralized enforcement mechanism is designed to provide a consistent and robust approach to upholding the Act's requirements across the state's digital landscape.

In addition to the Attorney General's role, the Department of Health is also granted authority under the Act. Specifically, the Department of Health may adopt additional criteria for what constitutes 'compulsive use' in relation to online services. This involvement highlights the legislative recognition of the public health implications of online engagement for minors, particularly concerning mental health and well-being. The collaborative effort between the Department of Law and Public Safety and the Department of Health underscores a comprehensive strategy to address both the legal and health-related aspects of online safety for young people in New Jersey. The Act also mandates that covered online service providers designate one or more officers responsible for compliance, creating an internal governance structure to ensure adherence to the new regulations.

Key Focus Areas

The New Jersey Age-Appropriate Design Code outlines several critical areas of focus to safeguard minors online. A primary emphasis is on 'privacy by default,' requiring covered online service providers to configure all privacy settings offered to minors at the highest level of privacy by default, unless the minor or their parent actively chooses a lower level. This includes restricting the visibility of a minor's online activity to other users and limiting direct messaging capabilities. Another significant focus is on data minimization, prohibiting the collection, sale, sharing, or retention of a minor's personal data unless it is necessary to provide the online service, or for specific, limited exceptions such as ensuring compliance with legal obligations. Providers are also explicitly forbidden from using a minor's personal data for targeted advertising, profiling, or for any purpose that is detrimental to the minor's physical or mental health or well-being.

The Act also addresses the insidious nature of 'dark patterns,' prohibiting their use to encourage minors to weaken their privacy protections or engage in activities that could be harmful. Furthermore, it mandates that online services provide an obvious signal when precise geolocation information is being collected or used, or when a minor's online activity is being monitored by an individual. Age assurance mechanisms are also a key component, requiring providers to implement reasonable methods to determine the age of users who are reasonably likely to be minors, without necessarily collecting excessive personal data for this purpose. The legislation also requires providers to take all reasonable steps to ensure that the design of their services does not result in compulsive use in minors, reflecting concerns about addictive design features.

Implementation Framework

The implementation framework for the New Jersey Age-Appropriate Design Code places significant obligations on covered online service providers. These providers are required to conduct a data protection impact assessment for any new online service, product, or feature, or for any material change to an existing one, before it is offered to the public. This assessment must identify and mitigate potential risks to the privacy and safety of minors. Furthermore, providers must clearly and conspicuously provide their terms of service, privacy policy, and community standards, using language that is clear and easily understood by the age group likely to access the service.

A crucial aspect of the implementation is the requirement for online services to provide easily accessible and effective tools for minors and parents to report harms, request account deletion, block other users, and customize media recommendations. Providers must also establish and maintain a publicly available privacy policy that specifically addresses how they process the personal data of minors. The Act emphasizes a 'safety-by-design' and 'privacy-by-default' approach, meaning that these protections should be integrated into the core design of the service, rather than being an afterthought. Compliance with these provisions will necessitate a thorough review and potential redesign of existing online services that are accessible to minors.

Monitoring and Evaluation

To ensure ongoing compliance and effectiveness, the New Jersey Age-Appropriate Design Code mandates a robust system of monitoring and evaluation. Covered online service providers are required to issue an annual report detailing various aspects of their service as it pertains to minors. This report must include a comprehensive description of the online service's covered design features, its use of personal data, and its business practices. It must also specify the purpose of the online service, the extent to which it is likely to be accessed by minors, and how the provider processes minors' personal data and sensitive personal data.

The annual report must further detail the design safety features and privacy protections adopted for minors, as well as the tools provided for parents. Providers are also required to disclose whether and how they use covered design features, their process for handling data access, deletion, and correction requests for minors' data, and the age assurance, age verification, or age estimation methods employed. Crucially, if algorithms are utilized, the report must explain how. For services using covered design features, the average daily time spent on the online service by covered minors for various percentiles must also be reported. These reports must be prominently posted on the provider's website and are subject to independent third-party audits, ensuring transparency and accountability. All personal data contained in these reports must be deidentified and aggregated.

Penalties, Liability, and Appeals

The New Jersey Age-Appropriate Design Code establishes significant penalties and avenues for liability for non-compliance. A violation of the Act's provisions, or any rules adopted thereunder, constitutes an unlawful practice and a violation of the New Jersey Consumer Fraud Act. This means that violators can face substantial monetary penalties: not more than $10,000 for a first offense and not more than $20,000 for any subsequent offense. The Office of the Attorney General has the authority to conduct civil investigations, bring civil actions, and enter into assurances of discontinuance to enforce these provisions.

Beyond governmental enforcement, the Act also provides for a private right of action. A covered child or minor who is injured by a violation of the Act's provisions may bring a civil action against the covered online service provider. Furthermore, the Office of the Attorney General or the parent of an injured minor may bring a civil action on behalf of the covered child or minor. For any negligent or greater violation, a court may award a prevailing plaintiff $5,000 per violation or treble damages, whichever is greater. Punitive damages may also be awarded for reckless or knowing violations, along with injunctive relief, declaratory relief, and attorney's fees and litigation costs. These robust penalty and liability provisions underscore the serious commitment to ensuring compliance and providing redress for harms suffered by minors online.

Relationship to Other Instruments

The New Jersey Age-Appropriate Design Code is designed to supplement and strengthen existing legal frameworks concerning data privacy and consumer protection within the state. It explicitly states that a violation of its provisions constitutes an unlawful practice under the New Jersey Consumer Fraud Act, P.L.1960, c.39. This integration means that the enforcement mechanisms and penalties available under the Consumer Fraud Act, including monetary penalties and the Attorney General's investigative powers, can be applied to breaches of the Kids Code. This linkage provides a powerful enforcement tool, leveraging established legal precedent and administrative capacity.

The Act also amends certain provisions of current law concerning data privacy, including modifying the definitions of “personal data” and “sensitive data” under N.J.S.A. 56:8-166.4. These amendments ensure consistency and expand the scope of protected data to align with the enhanced protections for minors. The legislation is intended to complement, rather than replace, other laws designed to protect children, such as federal safety laws and policies regulating the design of children's products. By building upon existing statutes and making targeted amendments, the New Jersey Age-Appropriate Design Code aims to create a cohesive and comprehensive legal environment for online child safety.

National/Federal Alignment

The New Jersey Age-Appropriate Design Code aligns with a growing national trend among U.S. states to enact stricter online privacy and safety regulations for minors, often drawing inspiration from the UK's Age-Appropriate Design Code. While there isn't a single comprehensive federal Age-Appropriate Design Code in the United States, this state-level initiative reflects widespread bipartisan agreement that more needs to be done to create safer online spaces for children. States like California, Maryland, Vermont, Nebraska, and South Carolina have already passed similar legislation, indicating a fragmented but determined movement towards enhanced youth online protections across the country.

The Act's principles, such as privacy by default, data minimization, and the prohibition of targeted advertising to minors, resonate with broader discussions at the federal level regarding children's online privacy, including aspects covered by the Children's Online Privacy Protection Act (COPPA). However, the New Jersey Kids Code Act goes further than COPPA by applying to minors up to 18 years of age (not just under 13) and by imposing design-based requirements on online services, rather than just parental consent mechanisms. This state-level action often serves to push the boundaries of regulation, potentially influencing future federal legislation or setting de facto standards that companies may adopt nationwide due to the complexities of state-by-state compliance. The New Jersey Act explicitly states that establishing age-appropriate privacy and safety design requirements is consistent with federal safety laws and policies regulating the design of children's products, emphasizing a complementary rather than conflicting approach.

Implementation Timeline

Compliance Checklist

Sources and References