New Jersey Children’s Privacy Laws (2026)

A4015 (Assembly, as enacted, substituted for S3413), P.L.2026, c.73

Enacted, not yet effective · Design code · effective 2027-09-01 · binds operators, platforms

Ages: Users the provider has actual knowledge are under 13 (covered children) or 13 to 17 (covered minors); actual knowledge includes its inferences and any age it has attributed to the user, including for marketing or advertising

Requires: Applies to a covered online service provider: a business operating in New Jersey with annual gross revenue above $25 million, or that processes the personal data of at least 25,000 consumers or households a year, whose public service displays account holders' content and makes interacting with other account holders' content a central feature (direct-messaging-only providers excluded) and is reasonably likely to be accessed by under-18s. For users it has actual knowledge are under 18 it must set every default privacy setting to the highest level (location and connections hidden, no search-engine indexing, interaction counts off and, if it uses an algorithmic recommendation system, no showing their content to, or direct messaging with, known adults other than a parent unless the young user opts in); it may not offer a single setting that weakens several defaults, may not prompt a weaker setting unless a feature the user or a parent requested needs it, and must offer blocking and a harm-reporting tool. It may not send them notifications by default, between 10 p.m. and 6 a.m., or from 8 a.m. to 4 p.m. on weekdays between Labor Day and Memorial Day, target them (or let advertisers target them) with ads for narcotic drugs, tobacco, gambling or alcohol, or use dark patterns. It must limit their personal data to its collection purpose and the minimum needed, recommend content only from listed inputs such as their settings, searches and express requests, use age-verification data for nothing else and delete it within 15 days of verifying age, honor unpublish requests within 10 business days and a minor's deletion request within 45 calendar days, signal when precise geolocation is collected or activity is monitored, and take all reasonable steps so its data use and design features do not result in compulsive use. A violation is an unlawful practice under the Consumer Fraud Act (N.J.S.A. 56:8-1 et seq.), enforceable by the Attorney General, and section 14 lets the injured child or minor, or a parent or the Attorney General on their behalf, sue for any negligent or greater violation for the greater of $5,000 per violation or treble damages, punitive damages for reckless or knowing violations, injunctive and declaratory relief, and attorneys' fees.

Timing: effective 2027-09-01, a derived date: section 17 makes the Act take effect on the first day of the 13th month following enactment, and the Legislature's bill history records approval as P.L.2026, c.73 on 2026-08-11

Litigation: No challenge to the Act identified in RECAP searches of the New Jersey federal courts and the Third Circuit or on NetChoice's and CCIA's litigation pages.

Entry last reviewed 2026-10-01

S332 (P.L.2023, c.266), N.J.S.A. 56:8-166.4 et seq.; Section 9 (56:8-166.12) amended by A5328 (P.L.2026, c.25)

In force · Privacy law (minors) · effective 2025-01-15 · binds operators

Ages: Consumers known to be at least 13 and under 17; under-13 processed per COPPA, and a known child's personal data may not be sold at all under the (a)(6) sensitive-data sale ban

Requires: A controller must obtain affirmative opt-in consent before selling personal data, processing it for targeted advertising, or using it for profiling in furtherance of decisions that produce legal or similarly significant effects, where the controller has actual knowledge or willfully disregards that the consumer is at least 13 but younger than 17 (N.J.S.A. 56:8-166.12(a)(8)). P.L.2026, c.25 (A5328), approved 2026-06-30 and effective immediately on approval, amended this section to add at (a)(6) a ban on selling sensitive data that applies regardless of the number of consumers whose data the entity controls or processes, which renumbered the minors clause from (a)(7) to (a)(8) without changing its wording or its 13-to-under-17 band. Personal data of a known child under 13 must be processed in accordance with federal COPPA (56:8-166.12(a)(4)); because the Act defines sensitive data to include personal data collected from a known child, the new (a)(6) also bars selling that data outright, and c.25 section 5 sets a civil penalty of $50,000 for each record sold, offered for sale, or licensed.

Litigation: No challenge to the Act or to c.25 identified in RECAP searches of the New Jersey federal courts and the Third Circuit or on NetChoice's and CCIA's litigation pages.

Entry last reviewed 2026-10-01