Serves under-18s, in New Jersey

N.J. Stat. Ann. § 56:8-162 (L. 2005, c.226, s.11) · Read the law's page

• This binds any business or public entity holding a customer's records containing personal information within its custody or control, whether or not the entity is otherwise subject to the New Jersey Data Privacy Act.
• Destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable, undecipherable, or non-reconstructable through generally available means.
• A willful, knowing, or reckless violation is deemed an unlawful practice under the Consumer Fraud Act, enforceable by the Attorney General and, separately, by an affected consumer through the Consumer Fraud Act's private right of action for an ascertainable loss.

N.J. Stat. Ann. section 56:8-166.4 et seq. (P.L. 2023, c. 266) · Read the law's page

• Applies to controllers subject to the New Jersey Data Protection Act that have actual knowledge, or willfully disregard, that a consumer is at least 13 but younger than 17 years of age.
• Obtain the consumer's own opt in consent before processing their personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.
• Treat personal data collected from a known child under 13 as sensitive data and process it in accordance with COPPA.

New Jersey Kids Code Act, A4015/S3413 (P.L. 2026, c. 73), supplementing N.J. Stat. Ann. Title 56 (Third Reprint) · Read the law's page

• This binds a covered online service provider: an entity that conducts business in New Jersey, whose online services are reasonably likely to be accessed by a child or minor, and that has annual gross revenue above $25,000,000 or annually processes the personal data of at least 25,000 consumers or households.
• Configure all default privacy settings for a covered child and covered minor to the highest level of privacy: not display the location of the child or minor to other users, not display the users connected to them, disable search engine indexing of the account and disable interaction counts, and, if you use an algorithmic recommendation system to select, recommend or prioritize media or contacts between users, not display the account's content or media to a covered adult other than a parent and prohibit direct messaging with a covered adult other than a parent, unless the child or minor has expressly and unambiguously chosen otherwise.
• Do not offer a covered child or covered minor a single setting that makes several default privacy settings less protective at once, and do not prompt them to make a privacy setting less protective unless the change is needed for a service or feature they or a parent have expressly requested.
• Offer a covered child or covered minor individual privacy settings to block specific users from accessing or interacting with their media and from communicating with them, including by direct message.
• Provide a prominent and accessible user interface for a covered child, covered minor and parent to report harms experienced on the online service.
• Do not send notifications to a covered child or covered minor by default, between 10:00 p.m. and 6:00 a.m., or on a weekday between Labor Day and Memorial Day between 8:00 a.m. and 4:00 p.m.
• Do not target, or allow an advertiser to target, an advertisement to a covered child or covered minor for narcotic drugs, tobacco products, gambling or alcohol, and do not use dark patterns in regard to a covered child or covered minor.
• Do not use the personal data of a covered child or covered minor for any reason other than the reason for which it was collected, and process or retain only the minimum amount needed for the specific features they have knowingly engaged.
• Do not use the personal data of a covered child or covered minor to select, recommend or prioritize media with an algorithmic recommendation system except on the grounds the Act lists, and give them and their parent an interface to set preferences for and review the data behind that system.
• If you collect personal data to verify a user's age, use it for nothing else and delete it not later than 15 days after verifying the age.
• Give a covered child or covered minor a prominent and accessible mechanism to have an account unpublished or permanently deleted, using the same number of steps or fewer than creating the account.
• Give a covered child or covered minor a prominent and constant real-time signal when precise geolocation information is collected or used or when their online activity is monitored by any individual, including a parent.
• Take all reasonable steps to ensure that your use of a covered child's or covered minor's personal data and the design of a covered design feature do not result in compulsive use.