State Children's Privacy Laws: Every U.S. Law Tracked (7)

What You Need to Know

New Jersey's Kids Code Act imposes strict design and data-handling requirements on "covered online service providers" — businesses conducting business in New Jersey with either $25 million+ in annual gross revenue or 25,000+ consumers/households processed, that own or control an online service reasonably likely to be accessed by a minor (with a 2%-of-audience-under-18 threshold as one trigger). Covered providers must default to the highest privacy settings for minors, restrict targeted advertising for narcotics, tobacco, gambling, and alcohol, prohibit dark patterns, limit push notifications during specified hours, minimize and limit retention of minors' data, and provide accessible account deletion. Unlike most state privacy laws, this one carries a private right of action for individuals under 18, with statutory damages of the greater of $5,000 per violation or treble damages — making this a materially higher-risk statute than a typical AG-enforcement-only privacy law. Effective September 1, 2027.