On 11 August 2026, New Jersey Governor Mikie Sherrill signed the New Jersey Kids Code Act (A4015) as part of a broader children’s online safety package. It takes effect 1 September 2027.

New Jersey is not the first state to pass an age-appropriate design code — California, Maryland, Nebraska and Vermont got there first, all borrowing from the UK’s Age Appropriate Design Code. What makes this one different is a single structural choice that industry fought hardest and lost: parents can sue, for $5,000 per violation.

That is the first private right of action in an American design code, and it changes the economics of the entire category.

What the Act Requires

The obligations attach to online services reasonably likely to be accessed by minors — the same coverage trigger the UK code uses, and deliberately broader than “directed at children” under COPPA. It reaches general-audience platforms, which is where most minors actually are.

Highest privacy settings on by default. For a user the platform knows to be a minor, the most protective available configuration is the starting state. Not the setting a diligent parent can find in a submenu — the default.

No notifications during school hours or late at night. A blunt, specific, testable rule. It is unusual for privacy legislation to regulate timing, and it is one of the few provisions that will produce an immediately observable change in a child’s phone.

No design features engineered for compulsive engagement. Infinite scroll, autoplay, streak mechanics, variable-reward notification schedules — the standard retention toolkit, aimed at minors, prohibited. This is the provision that will be litigated first and hardest, because “engineered for compulsive engagement” is a description of the modern consumer internet.

Data minimization and limits on targeted advertising. Collect what the service actually needs; do not build behavioural ad profiles on children.

The $5,000 Difference

Every other American design code is enforced by a state attorney general. That model has a known failure pattern: an AG office has a finite budget, a broad mandate, an election cycle, and a queue. It brings a small number of large cases, slowly, against the most visible defendants, and the remaining 95% of the market prices the risk at approximately zero.

A private right of action removes the bottleneck. Any parent with a claim becomes an enforcer. The defendant cannot triage; it faces distributed, unpredictable, simultaneous exposure across the whole user base rather than one negotiated settlement with one office.

Compare it to the $400 million TikTok settlement announced days later. That is the federal model at its most successful: one case, filed in 2024, settled in 2026, producing a number that sounds enormous and represents about six days of the defendant’s revenue. New Jersey’s model produces no headlines and no press conference — just an uninsurable, unpredictable liability that a general counsel has to model, and that scales with how many New Jersey minors use your product.

This is why the private right of action is the provision industry lobbies against in every state, every session, and why it was stripped out of federal proposals. It is not that it is unfair. It is that it works.

The Constitutional Fight Ahead

Nothing about the effective date is safe. California’s Age-Appropriate Design Code was substantially enjoined in NetChoice v. Bonta, with the Ninth Circuit finding that its Data Protection Impact Assessment requirement — compelling businesses to report on and mitigate content that could harm minors — likely compelled speech in violation of the First Amendment. Similar suits have followed other states.

New Jersey’s drafters clearly read those rulings. The Act leans on design and data rather than on content assessment, which is the distinction courts have been drawing: a rule about default settings, notification timing, data collection, and interface mechanics is a regulation of conduct; a rule requiring a platform to evaluate and suppress harmful content is a regulation of speech.

That distinction is real but not clean. A defendant will argue that “design features engineered for compulsive engagement” is an editorial judgment about how to present protected expression, and that a recommendation algorithm is speech. Expect the challenge before September 2027, and expect the compulsive-design provision to be the one at the centre of it.

The private right of action will also be attacked — on vagueness grounds, since a $5,000-per-violation exposure requires a defendant to know what counts as a violation with more precision than “reasonably likely to be accessed.”

The Age Problem That Nobody Has Solved

Every rule here begins with “for a user the platform knows to be a minor,” and that clause conceals the hardest problem in the field.

To apply minor-specific defaults, a platform must sort its users by age. To sort its users by age, it either asks (self-declaration, which children defeat instantly) or infers (behavioural age estimation, which means running a classifier over every user, adults included) or verifies (documents, which are now forgeable for about $15, and which turn a privacy law into a mandatory ID collection programme).

We saw all three failure modes this month: OpenAI’s age-prediction rollout with unpublished accuracy figures and ID upload as the appeal route; the collapse of document verification under generative forgery; and Australia’s regulator finding more than eight in ten under-16s still on social media a year into a ban.

New Jersey’s Act is better positioned than most because a default is safe to apply broadly. If you cannot tell whether a user is 15, the cautious response — apply the protective default to everyone — is cheap and harmless. Contrast an access ban, where uncertainty means either letting children through or locking adults out, and neither error is acceptable.

That is an underrated argument for design codes over age gates generally: design codes degrade gracefully under uncertainty, and access bans do not.

What To Do

  1. Set the defaults yourself now, and do not wait until September 2027. On every platform your child uses: private account, no discoverability by phone number or email, direct messages restricted to contacts, location off, ad personalisation off. The law is describing a configuration you can apply tonight.

  2. Turn off notifications on a schedule. iOS Focus and Android Digital Wellbeing both do quiet hours per-app. The Act mandates school hours and overnight; the research behind that provision applies to your household regardless of the effective date.

  3. Disable autoplay everywhere it exists. YouTube, TikTok, Instagram, Netflix. It is the single most effective compulsive-design lever and it is a toggle.

  4. Keep the receipts. A private right of action needs evidence. Screenshots of default settings on account creation, notification timestamps, and dark-pattern flows are exactly what a 2027 claim will be built from.

  5. If you are outside New Jersey, watch your own legislature. Design codes are spreading state by state, and the private-right-of-action provision is the one worth writing to a representative about. It is the difference between a law and a press release.