New Jersey Enacts Children's Online Safety Package, Including New Design Code Requirements

On August 11, 2026, New Jersey Governor Mikie Sherrill signed three measures addressing children’s and teens’ use of online services. A4015, the New Jersey Age-Appropriate Design Code (“NJ AADC” or the “New Jersey Kids Code Act”) imposes safety, privacy, data use, and design requirements on certain online service providers beginning September 1, 2027. A4014 establishes a Social Media Research Center at a New Jersey four-year public institution of higher education, while S3412 directs that Center to study warning labels and advertising disclaimers and authorizes the Department of Health to consider implementing the Center’s recommendations through rulemaking.

Like other emerging state laws addressing children’s and teens’ online privacy and safety, the NJ AADC reflects a broader state-led shift beyond the Children’s Online Privacy Protection Act (“COPPA”) framework of parental consent-based protections toward broader, more prescriptive restrictions. For a broader review of the US privacy landscape for children and teens, please see our recent Legal Update and US Children’s Privacy Legislation Tracker.

Who is Covered under the NJ AADC?

The NJ AADC applies to “covered online service providers,” which include legal entities that:

• Conduct business in New Jersey;
• Own, operate, control, or provide certain online services, or generate the majority of their annual revenue from such online services;
• Offer services that are reasonably likely to be accessed by a child or minor; and
• Either (1) have annual gross revenue exceeding $25 million¹ or (2) annually process the personal data of not less than 25,000 consumers or households.

The law also applies to persons that control or are controlled by and share common branding with such legal entities.

An “online service” must be public, display content generated by account holders, have at least one New Jersey account holder, and make interaction with content associated with other individual account holders a central feature.

Under the NJ AADC, an online service is “reasonably likely to be accessed” by children or minors if: it is directed to children under COPPA; competent and reliable evidence shows that at least 2% of its audience consists of individuals ages two through 17 who routinely access the service; or the provider knew or should have known that at least 2% of the audience included individuals in that age range.

Most of the NJ AADC's substantive obligations apply only with respect to "covered children" and "covered minors," meaning individuals whom the provider has actual knowledge to be under 18. “Actual knowledge” is defined broadly. It includes all age-related information already known to—and age-related inferences made by—the provider, including ages or age classifications used for marketing, advertising, product development, or user engagement. Providers therefore may be required to evaluate age signals across business functions, rather than relying solely on the birth date or age entered by the user.

Key Scope Limitations and Exemptions

The definition of "online service” excludes telecommunications services, broadband internet access services, email services, and the use, sale, or delivery of physical products. The definition of “covered online service provider” separately excludes an entity that solely provides direct messaging services or products.

The provisions of the NJ AADC does not apply to federal, state, tribal, or local government entities in their ordinary course of operations nor the following data and information: (1) information subject to Title V of the Gramm-Leach-Bliley Act (“GLBA”); (2) personal data governed under the Health Information Technology for Economic and Clinical Health Act (“HITECH”); (3) protected health information under the Health Insurance Portability and Accountability Act (“HIPAA”); (4) information, including, but not limited to, personal data that is collected as part of a clinical trial that is subject to the federal policy for the protection of human subjects under 45 C.F.R. Part 46; (5) information that is collected in accordance with the “Guideline for Good Clinical Practice” issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or (6) information that is collected in accordance with the human subject protection requirements of the United States Food and Drug Administration under 21 C.F.R. Part 50. Companies could benefit from reviewing these exemptions closely when evaluating whether particular data sets or business functions fall within the law's scope.

What Does the NJ AADC Require?

With respect to covered children and minors, providers must:

• Apply privacy-protective defaults. Configure the highest level of default privacy settings that meet minimum statutory requirements, including certain limitations on adult interactions, discoverability, location sharing, and engagement metrics.
• Provide meaningful user controls. Offer user blocking tools, recommendation preferences (if providing an algorithmic recommendation system), deletion and unpublishing mechanisms, and other controls designed to enhance minors' privacy and safety, including a harm-reporting interface.
• Limit notifications, advertising, and manipulative design practices. Restrict when notifications are sent (e.g., not between 10:00 p.m. and 6:00 a.m.), prohibit targeted advertising for specified products (e.g., narcotics, tobacco products, gambling, or alcohol), and refrain from using dark patterns.
• Limit personal data use, processing, and retention. Use personal data only for permitted purposes and process and retain only the minimum amount necessary for features with which the user knowingly engages.
• Address recommendation systems and compulsive use risks. Implement required controls for algorithmic recommendation systems and take all reasonable steps to ensure that personal data use and designs of covered design features do not result in compulsive use.

The NJ AADC also establishes specific requirements regarding single settings making multiple default privacy settings less protective, prompting to make privacy settings less protective, deletion of personal data collected for age verification, monitoring indicators, and geolocation collection and use.

Notably, the NJ AADC does not require a provider to prevent or preclude a child or minor from accessing or viewing content or media or to opine whether any piece of media is harmful.

NJ AADC Enforcement

• A violation of the NJ AADC constitutes an unlawful practice under the New Jersey Consumer Fraud Act and may be enforced by the Attorney General. As a result, covered entities may face not only the remedies available under the NJ AADC, but also the broader enforcement tools and penalties available under the Consumer Fraud Act.
• Covered children and minors, and their parents acting on their behalf, may bring civil actions against the provider. For negligent or more culpable violations, courts may award $5,000 per violation or treble damages (whichever is greater), injunctive and declaratory relief, attorneys’ fees, and litigation costs. Reckless or knowing violations may also support punitive damages.
• The NJ AADC provides no statutory cure period.

Companion Bill A4014: Social Media Research Center

A4014 establishes, subject to appropriation, a Social Media Research Center (the “Center”) at a four-year public institution of higher education to advance efforts in understanding social media use, mitigating the negative impacts of social media, and promoting healthy and responsible social media use.

The Center will study the impacts of social media consumption and mitigating negative impacts, make policy recommendations to address health challenges posed by social media use, provide free school training concerning safe social media use, and examine the impact of addictive social media behaviors on children and minors, and whether warnings and disclaimers reduce addictive social media behaviors.

While A4014 creates no direct compliance obligations, the Center’s research and recommendations may inform future legislation or agency action.

Companion Bill S3412: Social Media Warning-Label Study and Potential Rulemaking

S3412 directs the Center, in coordination with the Office of Youth Online Mental Health Safety and Awareness within the New Jersey Department of Health, to research and make recommendations concerning the impact of addictive social media behaviors on children and minors; the structure and design of warning labels on online services; the effectiveness of such warning labels in reducing addictive social media behaviors; and the impact of including mandatory disclaimers in advertisements of online services concerning the risks associated with addictive social media behaviors among covered children and minors.

The Center must evaluate warning label design, effectiveness, and provider burden at specified user touchpoints and report its recommendations by February 11, 2028.

Although S3412 does not immediately impose new compliance obligations on online service providers, the law authorizes the Commissioner of Health, following review of the Center's report and consultation with other state agencies, to adopt rules and regulations designed to implement the Center's recommendations and deter or reduce addictive social media behaviors among covered children and minors. Accordingly, businesses could view S3412 as a potential precursor to future regulatory requirements concerning warning labels, disclosures, and online service design practices.

Conclusion

Companies can benefit from assessing if they and each of their online services are covered by the NJ AADC and, if so, map existing practices against the law before its September 1, 2027 effective date. Although A4014 and S3412 do not currently impose direct operational requirements on online service providers, S3412 creates a potential pathway for future Department of Health rulemaking. Companies may therefore have a direct interest in monitoring developments related to the Center’s research and recommendations as they may inform future legislation.

¹ The $25 million threshold will be adjusted for inflation beginning in 2029.