Law / United States / 
New Jersey
S332, New Jersey Data Protection Act
N.J. Stat. Ann. section 56:8-166.4 et seq. (P.L. 2023, c. 266)
In force since .
An age-appropriate design code rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to controllers subject to the New Jersey Data Protection Act that have actual knowledge, or willfully disregard, that a consumer is at least 13 but younger than 17 years of age.
- Obtain the consumer's own opt in consent before processing their personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.
- Treat personal data collected from a known child under 13 as sensitive data and process it in accordance with COPPA.
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Enforced under the New Jersey Consumer Fraud Act by the Division of Consumer Affairs, with a cure period in place through mid 2026
Who enforces it
Enforcement body
New Jersey Division of Consumer Affairs
Settledness
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- Does the minors' consent duty in the New Jersey Data Protection Act reach processing beyond targeted advertising, sale and profiling in furtherance of decisions that produce legal or similarly significant effects, as the Division's FAQ answer that a controller "must get the consumer's consent before processing the consumer's personal data" for a consumer between 13 and 16 suggests?
- What facts show that a controller "willfully disregards" that a consumer is between the ages of 13 and 16 under the Act, when the Division's FAQ gives no example of conduct that amounts to willful disregard?
What it reaches
Age threshold
17
Covered services
Controllers subject to the New Jersey Data Protection Act processing data of a known child or minor
How the hook was established
express
What makes it apply
Data subject residence
What it makes you log
Logging duty
The row's duties are opt-in consent for a known 13 to 16 year old and COPPA handling of a known child's data, and neither names a log, record or proof of age. Section 9a(9) adds a separate data protection assessment duty that this entry does not rest on.
- Kind
- None
- As of
- Provision
- S332 (P.L.2023, c.266) section 9a(4) and (7)
What this law does
Requires a controller that has actual knowledge, or willfully disregards, that a consumer is at least 13 but younger than 17 years of age to obtain the consumer's own opt in consent before processing personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects, and treats personal data collected from a known child under 13 as sensitive data that must be processed in accordance with COPPA.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .