Law / United States / 
New Jersey
S332, New Jersey Data Protection Act
N.J. Stat. Ann. section 56:8-166.4 et seq. (P.L. 2023, c. 266)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 January 2025.
An age-appropriate design code rule binding private bodies.
As of 15 July 2026.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Requires a controller that has actual knowledge, or willfully disregards, that a consumer is at least 13 but younger than 17 years of age to obtain the consumer's own opt in consent before processing personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects, and treats personal data collected from a known child under 13 as sensitive data that must be processed in accordance with COPPA.
If you get it wrong
Private right of actionNo
Penalties
Enforced under the New Jersey Consumer Fraud Act by the Division of Consumer Affairs, with a cure period in place through mid 2026
Who enforces it
Enforcement body
New Jersey Division of Consumer Affairs
What it reaches
Age threshold
17
Covered services
Controllers subject to the New Jersey Data Protection Act processing data of a known child or minor
When LexLint raises it
serves_minors
Read the law
official New Jersey Legislature final bill text (Sixth Reprint, enacted as P.L. 2023, c. 266)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.