New Jersey Signs Kids Code to Strengthen Online Privacy and Safety

New Jersey Gov. Mikie Sherrill has signed three laws aimed at making social media and other online services safer for children. The package, signed Tuesday, August 11, puts new limits on how companies collect and use minors’ data. It also targets features designed to keep young users online for longer.

The main measure is the New Jersey Kids Code Act, which adopts an age-appropriate design standard for online services. New Jersey becomes the sixth state to enact a Kids Code law. The law becomes effective in September 2027, allowing companies time to adapt to the new requirements.

According to Sherrill, parents do not have to battle alone against tech companies in protecting their kids. She said the new laws make clear that companies must put children’s safety ahead of profits.

Stronger privacy defaults for minors

The Kids Code requires covered online services to set privacy controls for children and minors at their highest level by default. The law also limits the amount of personal data companies can collect and keep. Companies generally may only process the data needed to provide features that a young user knowingly uses.

Canada is moving in a similar direction with its proposed Online Harms Act, which would create a Digital Safety Commission to enforce child safety requirements and impose penalties for non-compliance, in addition to establishing new rights for users

The rules also address how platforms recommend content. Services cannot use a minor’s personal data to drive recommendations unless the recommendations are based on limited factors. These include user settings, searches, age rules or a clear request from the young user.

Children and parents will also get tools to control what content recommendation systems show them. They can set preferences and review data used to shape those recommendations.

The law takes aim at several common online risks as well. Platforms must limit direct messages between minors and adults unless the young user has clearly allowed the contact. They also must restrict the sharing of a minor’s location.

The rules cover online services that are likely to be used by children. That can include services aimed at children or those where at least 2% of the audience is between ages 2 and 17.

Law targets addictive design

The new rules go beyond privacy. Platforms must take reasonable steps to prevent their data practices and design features from causing what the law calls “compulsive use.” The term covers repeated use that is hard to stop and disrupts major parts of daily life.

The law also bars so-called dark patterns. These are design tricks that can push users toward choices they may not otherwise make.

Companies must also give minors and parents more control over recommendation systems. They must provide a clear way to change content preferences and review relevant personal data.

Account controls will also change. A user can ask a service to unpublish an account within 10 business days. Permanent deletion of a minor’s account must occur within 45 days after a deletion request.

The law carries serious enforcement powers. The New Jersey attorney general can investigate and sue companies over violations. A child injured by a violation can also bring a civil case, as can a parent or the attorney general on the child’s behalf.

For negligent or more serious violations, courts can award at least $5,000 per violation or three times the damages, whichever is greater. Punitive damages may also apply in reckless or knowing cases.

New research center will study social media

The other two laws take a different approach. One creates a Social Media Research Center at a four-year public college or university in New Jersey. Purpose of the Research Center? To examine the influence of social media and the internet on children and teenagers.

Activities in the research center will be mainly centered around screen time, online habits, mental health, and responsible social media usage. It will also develop training and public education programs.

Already, the state has added $500,000 to the 2027 budget to help move things forward at the research center. New Jersey officials hope to have it operating this fall. The third law directs the center to study mental health warning labels for social media.

Researchers also want to see if warnings can actually steer young people away from dangerous or addictive habits online.  They will study labels shown when children create accounts, enter or leave a service, reach set periods of daily use, or show signs of addictive behavior.

The center must issue a final report within 18 months. Its findings could then help shape future state rules.

Tech industry raises legal concerns

The laws have drawn strong support from child safety and privacy groups. The Electronic Privacy Information Center said the Kids Code shifts more responsibility toward platforms rather than families.

However, industry associations have issued warnings regarding the bill. The Computer & Communications Industry Association warned during the legislative process that certain clauses of the bill could be unconstitutional and would pose issues regarding privacy.

It further stated that vague laws could be difficult for businesses to comply with, as well as hinder lawful expression. That debate is likely to continue as companies prepare for the law.

For now, New Jersey is one of the increasing number of states striving to reform the way online platforms deal with children. However, the true challenge will be in 2027 when the law will take effect. Going forward, companies would have to consider the new standards when making any product changes.