New Jersey Children's Privacy Laws (2026)

S3993 — Requires age verification and parental/guardian consent for a minor's use of a social media platform; prohibits certain adult-minor messaging (222nd Legislature, 2026-2027 session) · S3993 (222nd Legislature, 2026-2027)

Pending — A bill was introduced this cycle but is not yet law. · Social media · binds operators, platforms

Ages: minors (under 18)

Requires: Bars a social media company from permitting a NJ-resident minor to be an account holder without express parent/guardian consent (parent must provide government ID + credit card and consent to a fee up to 35 cents). Company must verify age of new/existing account holders at signup or within 14 days of access attempt; prohibits direct messaging between a minor's account and unlinked adult users; limits data collection from minor accounts. Enforced by the Division of Consumer Affairs (penalties up to $2,500/violation) plus a private right of action.

Litigation: None — bill is not law, so no injunction exists.

New Jersey Kids Code Act (Age-Appropriate Design Code for New Jersey) · S3413 (Senate); A4015 (Assembly companion)

Pending — A bill was introduced this cycle but is not yet law. · Design code · binds operators, platforms

Ages: Known minors under 18

Requires: Would require covered online service providers to default known-minor accounts to the highest available privacy/safety settings, bar reducing or prompting minors to reduce those settings, and limit data collection to the minimum necessary for the requested service. Prohibits using a minor's personal data beyond the purpose collected, targeted advertising to minors, profiling except as needed for the service, and dark patterns; age-verification data must be deleted within 60 days.

New Jersey Data Privacy Act — minors' provisions · S332 (P.L. 2023, c. 266)

In force — Effective and enforceable today. · Privacy law (minors) · effective 2025-01-15 · binds operators

Ages: Consumers known to be at least 13 and under 17; under-13 deferred to COPPA

Requires: A controller must obtain affirmative opt-in consent before selling personal data, processing it for targeted advertising, or using it for profiling that produces legal or similarly significant effects, where the controller has actual knowledge or willfully disregards that the consumer is at least 13 but younger than 17. The online privacy of children under 13 is handled under federal COPPA rather than separate state provisions.