Law / United States / New Jersey

A4015/S3413, New Jersey Kids Code Act

New Jersey Kids Code Act, A4015/S3413 (2026), supplementing N.J. Stat. Ann. Title 56 (Third Reprint)

An age-appropriate design code rule binding private bodies.

Private right of action

Yes

As of 15 October 2026.

What it requires

• This binds a covered online service provider: an entity that conducts business in New Jersey, whose online services are reasonably likely to be accessed by a child or minor, and that has annual gross revenue above $25,000,000 or annually processes the personal data of at least 25,000 consumers or households.
• Configure all default privacy settings for a covered child and covered minor to the highest level of privacy: not display the location of the child or minor to other users, not display the users connected to them, disable search engine indexing of the account and disable interaction counts, and, if you use an algorithmic recommendation system to select, recommend or prioritize media or contacts between users, not display the account's content or media to a covered adult other than a parent and prohibit direct messaging with a covered adult other than a parent, unless the child or minor has expressly and unambiguously chosen otherwise.NIST Privacy FrameworkGV.PO-P2
• Do not offer a covered child or covered minor a single setting that makes several default privacy settings less protective at once, and do not prompt them to make a privacy setting less protective unless the change is needed for a service or feature they or a parent have expressly requested.NIST Privacy FrameworkCT.PO-P3
• Offer a covered child or covered minor individual privacy settings to block specific users from accessing or interacting with their media and from communicating with them, including by direct message.NIST Privacy FrameworkCT.PO-P3
• Provide a prominent and accessible user interface for a covered child, covered minor and parent to report harms experienced on the online service.no control in the NIST Privacy Framework
• Do not send notifications to a covered child or covered minor by default, between 10:00 p.m. and 6:00 a.m., or on a weekday between Labor Day and Memorial Day between 8:00 a.m. and 4:00 p.m.no control in the NIST Privacy Framework
• Do not target, or allow an advertiser to target, an advertisement to a covered child or covered minor for narcotic drugs, tobacco products, gambling or alcohol, and do not use dark patterns in regard to a covered child or covered minor.NIST Privacy FrameworkCT.PO-P1
• Do not use the personal data of a covered child or covered minor for any reason other than the reason for which it was collected, and process or retain only the minimum amount needed for the specific features they have knowingly engaged.NIST Privacy FrameworkCT.PO-P1
• Do not use the personal data of a covered child or covered minor to select, recommend or prioritize media with an algorithmic recommendation system except on the grounds the Act lists, and give them and their parent an interface to set preferences for and review the data behind that system.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
• If you collect personal data to verify a user's age, use it for nothing else and delete it not later than 15 days after verifying the age.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCT.PO-P1
• Give a covered child or covered minor a prominent and accessible mechanism to have an account unpublished or permanently deleted, using the same number of steps or fewer than creating the account.NIST Privacy FrameworkCT.PO-P3
• Give a covered child or covered minor a prominent and constant real-time signal when precise geolocation information is collected or used or when their online activity is monitored by any individual, including a parent.NIST Privacy FrameworkCM.AW-P3
• Take all reasonable steps to ensure that your use of a covered child's or covered minor's personal data and the design of a covered design feature do not result in compulsive use.no control in the NIST Privacy Framework

These lines are LexLint's reading of the law's text, as of 15 October 2026.

In the frameworks

NIST Privacy Framework

• GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
• CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
• CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
• CT.DM-P5Data are destroyed according to policy.
• CM.AW-P3System/product/service design enables data processing visibility.

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Who enforces it

What it reaches

When LexLint raises it

When your app profile says your app operates a social platform or serves under-18s.

Back to the example  ·  Lint your app