A 4015

[Third Reprint]
ASSEMBLY COMMITTEE SUBSTITUTE FOR
ASSEMBLY, No. 4015
STATE OF NEW JERSEY
222nd LEGISLATURE
� ADOPTED
JUNE 8, 2026
Sponsored by:
Assemblywoman� ANDREA KATZ
District 8 (Atlantic and Burlington)
Assemblywoman� MARISA SWEENEY
District 25 (Morris and Passaic)
Assemblywoman� LUANNE M. PETERPAUL
District 11 (Monmouth)
Senator� RAJ MUKHERJI
District 32 (Hudson)
Senator� LINDA R. GREENSTEIN
District 14 (Mercer and Middlesex)
Co-Sponsored by:
Assemblyman Karabinchak, Assemblywoman Morales, Assemblymen
Kearney, Singh, Spearman, Assemblywoman Speight, Senators A.M.Bucco, Beach,
Moriarty, McKnight and Turner
SYNOPSIS
���� �New Jersey Kids Code Act�; adopts New Jersey
Age-Appropriate Design Code and requires certain online service providers to
implement certain measures concerning minors� use of online service.
CURRENT VERSION OF TEXT
���� As amended by the Senate on June 30, 2026.
An Act concerning online privacy for minors and
supplementing Title 56 of the Revised Statutes.
���� Be It Enacted by the Senate and General Assembly of the State of New Jersey:
���� 1.��� This act shall be known
and may be cited as the �New Jersey Age-Appropriate Design Code.�
���� 2.��� The Legislature finds
and declares that:�
���� a.���� New Jersey and the
United States are facing a youth mental health crisis, with rates of adolescent
suicides, depressive episodes, and feelings of sadness and hopelessness
increasing significantly in recent years. �
���� b.��� Studies have shown a
correlation between high internet usage and increased risks of depression,
anxiety, loneliness, and suicidal ideation, particularly in adolescents and
young adults. �
���� c.���� According to the Pew
Research Center, in 2022, 46 percent of American teenagers aged 13 through 17
reported using the Internet almost constantly.
���� d.��� As children and youth spend
more time interacting with the online world, the impact of the design of online
services on their well-being has become a focus of significant concern.
���� e.���� There is widespread and
bipartisan agreement in the United States that more needs to be done to create
a safer online space for children to learn, explore, and play.
���� f.���� Lawmakers throughout
the United States and in New Jersey have taken steps to enhance online privacy
protections and security for children.
���� g.��� On September 15, 2025,
the Growing Up Online report advised the Legislature to pass legislation requiring
online platforms to implement strong default privacy settings for minors,
restrict data collection and third-party access, and protect against targeted
advertising, invasive tracking, and addictive design features.
���� h.��� Online services that are
reasonably likely to be accessed by children should offer strong privacy
protections by design and by default, as well as prevent the use of children�s
personal data in ways that are reasonably likely to result in the sexual
exploitation, abuse, discrimination, financial harm, or physical harm of
children.
���� i.���� Establishing
age-appropriate privacy and safety design requirements for online services used
by children is consistent with federal safety laws and policies regulating the
design of children�s products, ranging from toys and clothing to furniture and
games, to prevent children from suffering harm at the hands of these products.
���� j.���� Therefore, it is
essential for the Legislature to promote the health and safety of children and
youth online by ensuring online services have age-appropriate designs that
reflect the unique risks and challenges that these online services may have for
young people.
���� 3.��� As used in
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill):�
���� �Actual knowledge� is all
information known to and inferences made by the covered online service provider
relating to the age of an individual, including, but not limited to, the
individual�s declared age, age flags, a commercially-reasonable and technically-feasible
age assurance mechanism, and any age the covered online service provider has
attributed or associated with the individual for any purpose, including
marketing, advertising, or product development. �If a covered online service
provider�s classification of an individual for any purpose, including
marketing, advertising, or user engagement is inconsistent with the
individual�s declared age, a covered online service provider shall disregard
the declared age for purposes of P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill).
���� �Adult� means an individual
who is 18 years of age or older.
���� �Algorithmic recommendation
system� means a computational process used to determine the selection, order,
rank, relative prioritization, or relative prominence of media provided to a
user through an online service, product, or feature, including search results,
ranking, recommendations, display, or any other method of automated selection.�
�Algorithmic recommendation system� does not include a computational process
that:�
���� a.���� enables users to find
specific other users on a covered online service provider�s service, such as by
entering individual information as a search query or uploading a list of
contacts; or
���� b.��� otherwise returns media
responsive to a user�s search query, as long as the system does not:� process
other personal data of the user to determine the selection, order, rank,
relative prioritization, or relative prominence of the media; or associate the
search query with the user after the search results are returned.
���� �Child� means an individual
under the age of 13.
���� �Collect� means buying,
renting, gathering, obtaining, receiving, or accessing any personal data
pertaining to an individual by any means, including, but not limited to,
receiving information from an individual, either actively or passively, or by
observing the individual�s behavior.
���� �Compulsive use� means a
pattern of use of a covered online service provider�s online service that, at a
minimum: �(1) is repetitive and difficult for a user to stop or reduce despite
a desire to do so; and (2) materially disrupts one or more major life
activities, including but not limited to sleeping, eating, learning, reading,
communicating, or working.
���� �Consumer Price Index� means
the most comprehensive index of consumer prices available for this State from
the Bureau of Labor Statistics of the United States Department of Labor.
���� �Controls� or �controlled by�
means:�
���� a.���� ownership of, or the
power to vote, more than 50 percent of the outstanding shares of any class of
voting security of the legal entity;
���� b.��� control in any manner
over the election of a majority of the directors of the legal entity, or of
individuals exercising similar functions in the legal entity; or
���� c.���� power to exercise a
controlling influence over the management of the legal entity.
���� �Covered adult� means an
individual that a covered online service provider has actual knowledge is an
adult.
���� �Covered child� means an
individual that a covered online service provider has actual knowledge is a
child.
���� �Covered design feature� means
a feature or component of an online service for which there is an associated
risk of resulting compulsive use, including, but not limited to, features 2[primarily
designed to]
that2
encourage or increase a user�s frequency, time spent, or activity on the online
service. ��Covered design feature� also includes, but is not limited to:�
���� a.���� infinite scroll or a
design feature where content automatically and continuously loads;
���� b.��� auto-playing video or
audio, or a design feature in which a video or audio automatically begins
playing when a user navigates to, or scrolls through, a set of videos without
any explicit action on the part of a user indicating the user�s desire to watch
that video or listen to that audio;
���� c.���� gamification, or a
design feature that emulates gameplay, including, but not limited to, a streak,
badge, or reward that motivates or causes more frequent or more extensive use
of an online service through incentives;
���� d.��� the use of clustering or
timing of notifications or push alerts, irrespective of content, to encourage a
user to return to the online service;
���� e.���� design features in
which virtual currencies are used or where digital items are purchased;
���� f.���� appearance-altering
filters;
���� g.��� requiring, or repeatedly
prompting, the creation of an account in order to access publicly available
user-generated content;
���� h.��� the use of ephemerality
to prompt the urgent use of an online service; and
���� i.���� intermittent variable
reward schedules.
���� �Covered minor� means an
individual who a covered online service provider has actual knowledge is a
minor.
���� �Covered online service
provider� means:�
���� a.���� a sole proprietorship,
limited liability company, corporation, association, or any other legal entity:�
���� (1)�� that owns, operates,
controls, or provides an online service, or generates the majority of its
annual revenue from online services;
���� (2)�� that conducts business
in this State;
���� (3)�� whose online services
are reasonably likely to be accessed by a 2child or2 minor;
and
���� (4)�� (a) that has annual
gross revenue in excess of $25,000,000.� Beginning January 1, 2029, and every
two years thereafter, the Department of the Treasury shall adjust the amount of
annual gross revenue to reflect the percentage change in the Consumer Price
Index; or
���� (b)�� that annually processes
the personal data of not less than 25,000 consumers or households; or
���� b.��� a person that controls
or is controlled by a legal entity described in subsection a. of this
definition and that shares common branding with the legal entity.
���� 2A �covered
online service provider� 3[is a
controller for the purposes of P.L.2023, c.266 (C.56:8-166.4 et seq.)] does not
include an entity that solely provides a direct messaging service or product3 .2
���� �Dark pattern� means a user
interface designed or manipulated with the substantial effect of subverting or
impairing user autonomy, decision-making, or choice and includes, but is not
limited to, any practice the United States Federal Trade Commission refers to
as a �dark pattern.�
���� 1[�Device� means
any electronic equipment capable of collecting, processing, retaining, or
transferring personal data.]1
���� �Minor� means an individual
who is at least 13 years of age but less than 18 years of age.
���� �Online service� means 3[any service,
product, or feature provided over the Internet that collects, uses, stores,
discloses, analyzes, deletes, or modifies the personal data of consumers.�
�Online service� includes, but is not limited to, a website or application.�
�Online]
a service or product that:� (1) is accessible to the public via the
Internet; (2) displays content that is generated by one or more account
holders; (3) has an account holder in this State; and (4) allows account
holders to interact with content associated with other individual account
holders as a central feature of the service.
���� �Online3
service� does not include:�
���� a.���� a �telecommunications
service,� as that term is defined in 47 U.S.C. s.153;
���� b.��� a �broadband internet
access service,� as that term is defined in 47 C.F.R. s.8.1; 2[or]2
���� c.���� 2an
email service; or
���� d.2�� the
sale, delivery, or use of a physical 1[device] product1.
���� �Parent� means a legal
guardian.
���� �Personal data� means any
information that is linked or reasonably linkable to an identified or
identifiable person. ��Personal data� shall not include de-identified data or
publicly available information. �
���� �Precise geolocation data�
means information derived from technology, including, but not limited to,
global positioning system level latitude and longitude coordinates or other
mechanisms, that directly identifies the specific location of an individual with
precision and accuracy within a radius of 1,750 feet. ��Precise geolocation
data� does not include the content of communications or any data generated by
or connected to advanced utility metering infrastructure systems or equipment
for use by a utility.
���� �Process� or �processing�
means an operation or set of operations performed, whether by manual or
automated means, on personal data or sets of personal data, such as the
collection, use, storage, disclosure, analysis, deletion, or modification of
personal data, and includes the actions to direct the processing of personal
data.
���� �Publicly available
information� means information that is lawfully made available from federal,
State, or local government records or widely distributed media or information
for which there is a reasonable basis to believe that an individual has lawfully
made available to the general public and has not restricted to a specific
audience.
���� �Reasonably likely to be
accessed� means an online service is reasonably likely to be accessed by a
covered child or covered minor because:�
���� a.���� the online service is a
�website or online service directed to children,� as that term is defined by
the �Children�s Online Privacy Protection Act,� 15 U.S.C. s.6501 et seq. and
the Federal Trade Commission rules implementing that act;
���� b.��� at least two percent of
the audience of the online service is determined, based on competent and
reliable evidence regarding audience composition, to be routinely accessed by
individuals who are two through 17 years of age; or
���� c.���� the covered online
service provider knew or should have known that at least two percent of the
audience of the online service includes individuals two through 17 years of
age, provided that, in making this assessment, the covered online service
provider shall not collect or process any personal data that is not reasonably
necessary to provide an online service with which a covered child or covered
minor is actively and knowingly engaged.
���� �Search engine indexing� means
the process by which search engines collect, parse, crawl, analyze, organize,
or store web content to facilitate accurate information retrieval.
���� �User� means an individual
whose personal data is directly or indirectly collected, used, stored,
disclosed, analyzed, deleted, modified, or otherwise processed by a covered
online service provider.
���� 4.��� a.� A covered online
service provider shall configure all default privacy settings for a covered
child and covered minor to the highest level of privacy, including, but not
limited to:�
���� (1)�� for a covered online
service 2provider2 that
uses an algorithmic recommendation system to select, recommend, or prioritize
media or contacts between users:�
���� (a)�� not displaying the 2[existence] content2 of a
covered child�s or covered minor�s account to a covered adult unless the
covered adult is the parent thereof, or the covered child or covered minor has
expressly and unambiguously allowed the covered adult to view the covered
child�s or covered minor�s account, or the covered child or covered minor has
expressly and unambiguously chosen to make the covered child�s or covered
minor�s account 2[existence]2
public;
���� (b)�� not displaying media
created or posted by a covered child or covered minor to a covered adult unless
the covered adult is the parent thereof, or the covered child or covered minor
has expressly and unambiguously allowed the covered adult to view the covered
child�s or covered minor�s media, or the covered child or covered minor has
expressly and unambiguously chosen to make the covered child�s or covered
minor�s media publicly available; and
���� (c)�� prohibiting direct
messaging between a covered child or covered minor and a covered adult unless
the covered adult is the parent thereof, or the covered child or covered minor
has expressly and unambiguously chosen to allow direct messaging with the covered
adult;
���� (2)�� prohibiting the display
of a covered child�s or covered minor�s location to other users, unless the
covered child or covered minor has expressly and unambiguously chosen to share
the covered child�s or covered minor�s location with a specific user;
���� (3)�� not displaying the users
connected to a covered child or covered minor;
���� (4)�� disabling search engine
indexing of a covered child�s or covered minor�s account; and
���� (5)�� disabling all
interaction counts, including but not limited to comments, reactions, and
reshares, and offering:�
���� (a)�� settings to enable or
disable specific types of interaction counts; and
���� (b)�� a single setting to
enable all interaction counts at once, provided the settings to enable specific
types of interaction counts are equally or more prominent and accessible than
the setting to enable all interaction counts at once.
���� b.��� A covered online service
provider shall not:�
���� (1)�� provide a covered child
or covered minor with a single setting that makes multiple default privacy
settings less protective at once; or
���� (2)�� request or prompt a
covered child or covered minor to make privacy settings less protective, unless
the change is necessary to access a service or feature a covered child, covered
minor, or parent of a covered child or covered minor has expressly and unambiguously
requested.
���� c.���� A covered online
service provider shall offer individual, accessible privacy settings to a
covered child or covered minor that allows a covered child or covered minor the
option to block specific users from, at minimum:�
���� (1)�� accessing the media of a
covered child or covered minor;
���� (2)�� interacting with the
media of a covered child or covered minor; and
���� (3)�� communicating with a
covered child or covered minor through any means offered by the covered online
service provider, including direct messaging.
���� 5.��� A covered online service
provider shall establish a prominent and accessible user interface to enable a
covered child, covered minor, and parent of a covered child or covered minor to
report harms experienced by the covered child or covered minor on the online
service.
���� 6.��� A covered online service
provider shall not:�
���� a.���� send notifications to
any covered child or covered minor by default;
���� b.��� send notifications to a
covered child or covered minor between 10:00 p.m. and 6:00 a.m. and, on a
weekday between Labor Day and Memorial Day, between 8:00 a.m. and 4:00 p.m.;
���� c.���� target, or allow an
advertiser to target, an advertisement to a covered child or covered minor for
narcotic drugs, tobacco products, gambling, or alcohol; or
���� d.��� use dark patterns in
regard to a covered child or covered minor.
���� 7.��� a.� A covered online
service provider shall not:�
���� (1)�� use the personal data of
a covered child or covered minor for any reason other than the reason for which
the personal data was collected; or
���� (2)�� use the personal data of
a covered child or covered minor to select, recommend, or prioritize media using
an algorithmic recommendation system unless the selection, recommendation, or
prioritization of media is based on:� user-selected privacy or accessibility
settings; a user�s search query, if the query is used only to select and
prioritize media in response to the query; parent-selected privacy or
accessibility settings; a user�s age or age flag, only if the data is used to
implement the covered online service�s age-appropriate content policies; or the
covered child�s or covered minor�s express and unambiguous request to receive:�
���� (a)�� media from a specific
account, feed, or user, or to receive more or less media from that account,
feed, or user;
���� (b)�� a specific category of
media, such as videos depicting specific types of content, or to view more or
less of that category of media; or
���� (c)�� more or less media with
similar characteristics as the media the covered child or covered minor is
currently viewing.
���� b.��� A covered online service
provider shall only process or retain the minimum amount of a covered child�s
or covered minor�s personal data that is necessary to provide the specific
features of the online service with which the covered child or covered minor
has knowingly engaged.
���� 8.��� a.� A covered online
service provider is not required to collect the personal data of a user to
comply with the provisions of P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill).
���� b.��� A covered online service
provider that collects a user�s personal data for purposes of age 2[verification] 3[assurance2] verification3 shall
not use that personal data for any other purpose and shall delete that personal
data not later than 15 days after 2[verifying] 3[determining2] verifying3 the
user�s age.
���� 9.��� A covered online service
provider shall provide a prominent and accessible mechanism for a covered child
or covered minor to request that the covered child�s or covered minor�s account
be unpublished or permanently deleted.� The mechanism shall require the same
number or fewer steps than required for a covered child or covered minor to
create an account on the covered online service provider.� A covered online
service provider shall unpublish 2[or permanently
delete, as appropriate,]2
the covered child�s or covered minor�s account not later than 10 business days
after submission of the request 2to
unpublish and shall permanently delete the covered minor�s account not later
than 45 calendar days after submission of the request to permanently delete2.
���� 10.� a.� A covered online
service provider that uses an algorithmic recommendation system shall establish
a prominent and accessible user interface to enable a covered child, covered
minor, and parent of a covered child or covered minor to:�
���� (1)�� communicate preferences
about which types of media are to be recommended or blocked in the output of
the relevant algorithmic recommendation system; and
���� (2)�� access, review, and make
changes to any personal data the covered online service provider uses to
determine the output of the relevant algorithmic recommendation system.
���� b.��� A covered online service
provider shall ensure the selection, recommendation, and prioritization of
media in an algorithmic recommendation system is informed by the preferences
communicated via the user interface described in subsection a. of this section.
���� 11.� A covered online service
provider shall provide a prominent and constant real-time signal to a covered
child or covered minor when precise geolocation information is being collected
or used or the online activity of that covered child or covered minor is being
monitored by any individual, including a parent of the covered child or covered
minor.
���� 12.� a.� A covered online
service provider shall take all reasonable steps to ensure that the covered
online service provider�s use of a covered child�s or covered minor�s personal
data and the design of a covered design feature do not result in compulsive use
in a covered child or covered minor.
���� b.��� Nothing in this section
shall be construed to require a covered online service provider to prevent or
preclude a covered child or covered minor from accessing or viewing content or
media, or to opine whether any piece of media is harmful.
���� 13.� a.� The Attorney General
may adopt, pursuant to the �Administrative Procedure Act,� P.L.1968, c.410
(C.52:14B-1 et seq.), rules and regulations as may be necessary to implement
the provisions of P.L.    , c.
(C.        ) (pending before the
Legislature as this bill).
���� b.��� The Commissioner of
Health may adopt, pursuant to the �Administrative Procedure Act,� P.L.1968,
c.410 (C.52:14B-1 et seq.), additional criteria for what constitutes �compulsive
use� as that term is defined in section 3 of P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill).
���� 14.� a.� A violation of
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill), or any rules adopted thereunder, shall constitute an
unlawful practice and violation of P.L.1960, c.39 (C.56:8-1 et seq.).
���� b.��� The Attorney General
shall have the same authority under P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill) to conduct civil investigations,
bring civil actions, and enter into assurances of discontinuance as provided
under P.L.1960, c.39 (C.56:8-1 et seq.).
���� c.���� A covered child or covered
minor injured by a violation of P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill) may bring a civil action against
the covered online service provider.� The Attorney General or the parent of a
covered child or covered minor injured by a violation of
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill) may bring a civil action on the covered child�s or
covered minor�s behalf against the covered online service provider.� For any
negligent or greater violation of P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill), a court may award a prevailing
plaintiff, as appropriate:�
���� (1)�� $5,000 per violation or
treble damages, whichever is greater;
���� (2)�� punitive damages for
reckless or knowing violations;
���� (3)�� injunctive relief;
���� (4)�� declaratory relief; and
���� (5)�� attorney�s fees and
litigation costs.
���� d.��� Any violation of
sections 4 through 12 of P.L.    , c.
(C.  through
C.        ) (pending before the
Legislature as this bill) as to any covered child or covered minor shall
constitute an injury to that covered child or covered minor for the purposes of
subsection c. of this section.
���� 15.� The provisions of
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill) shall not apply to:�
���� a.���� a federal, State,
tribal, or local government entity in the ordinary course of operations; or
���� b.��� the following data and
information:�
���� (1)�� information subject to Title
V of the �Gramm-Leach-Bliley Act� (15 U.S.C. s.6801 et seq.);
���� (2)�� personal data governed
under the �Health Information Technology for Economic and Clinical Health Act�
(42 U.S.C. s.17921 et seq.);
���� (3)�� protected health
information under the �Health Insurance Portability and Accountability Act of
1996,� Pub.L. 104-191, and regulations promulgated thereunder;
���� (4)�� information, including,
but not limited to, personal data that is collected as part of a clinical trial
that is subject to the federal policy for the protection of human subjects
under 45 C.F.R. Part 46;
���� (5)�� information that is
collected in accordance with the �Guideline for Good Clinical Practice� issued
by the International Council for Harmonisation of Technical Requirements for
Pharmaceuticals for Human Use; or
���� (6)�� information that is
collected in accordance with the human subject protection requirements of the
United States Food and Drug Administration under 21 C.F.R. Part 50.
���� 16.� a.� The provisions of
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill) shall not limit or restrict in any way the
application of other laws, statutes, rules, or regulations of this State.
���� b.��� Nothing in
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill) shall be interpreted or construed to:�
���� (1)�� impose liability in a
manner that is inconsistent with 47 U.S.C. s.230;
���� (2)�� impose liability in a
manner that is inconsistent with the First Amendment of the United States
Constitution or Article One of the New Jersey Constitution; or
���� (3)�� preempt or otherwise
affect any right, claim, remedy, presumption, or defense available at law or in
equity, including but not limited to anti-discrimination, consumer protection,
labor, and civil rights laws.
���� c.���� If any clause,
sentence, paragraph, subparagraph, subsection, section or part of
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill) shall be adjudged by any court of competent
jurisdiction to be invalid, such judgment shall not affect, impair, or
invalidate the remainder thereof, but shall be confined in its operation to the
clause, sentence, paragraph, subparagraph, subsection, section or part thereof
directly involved in the controversy in which such judgment shall have been
rendered.� It is hereby declared to be the intent of the Legislature that
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill) would have been enacted even if such invalid
provisions had not been included herein.
���� d.��� The provisions of
P.L.    , c.
(C.        ) (pending before the
Legislature as this bill), shall apply to conduct that occurs in whole or in
part in New Jersey.
���� 2e.�� The
obligations of a covered online service provider pursuant to P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill) shall apply with respect to each
online service provided by the covered online service provider.
���� 3[f. In the
event of a conflict between the provisions of P.L.    ,
c.    (C.        )
(pending before the Legislature as this bill) and the provisions of another law
or laws of this State, the law that affords minors the greatest protection from
harm shall control.2]3
���� 17.� This act shall take
effect on the first day of the 13th month following the date of enactment.��