A PYMNTS Company

A New Design Code Takes Root in the Garden State

 |  August 20, 2026
payments-firms-AI-proof-standard

By: Daniel Hales (Future of Privacy Forum)

    Get the Full Story

    Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

    yesSubscribe to our daily newsletter, PYMNTS Today.

    By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.

    In this short piece for the Future of Privacy Forum, author Daniel Hales takes a look at New Jersey’s newly enacted Age-Appropriate Design Code (NJAADC), signed into law on August 11. The law is among the broadest state design codes to date, applying to online services likely to be accessed by minors that meet specified revenue or data-processing thresholds. It will take effect on September 1, 2027, and includes a private right of action.

    Hales explains that the NJAADC applies to both children under 13 and minors ages 13 to 17, while imposing the same obligations on both groups. Covered services must implement protective default settings, including controls over algorithmic recommendations, restrictions on contact between minors and unknown adults, limits on geolocation visibility, and options to block other users. The law also prevents companies from using single settings or prompts to weaken multiple protective defaults.

    The law also establishes broad restrictions on how services use minors’ data and design their platforms. These include purpose limitations, data minimization and retention requirements, restrictions on personalized recommendations, measures against compulsive design features such as infinite scroll and autoplay, notification curfews, limits on certain targeted advertising, and a broad prohibition on dark patterns. Services must additionally provide accessible mechanisms for reporting harms and quickly deleting accounts.

    The author then goes on to highlight the NJAADC’s robust enforcement provisions, which allow actions under New Jersey’s Consumer Fraud Act as well as a separate private right of action. Courts may award $5,000 per violation or treble damages, along with punitive damages and other relief for qualifying violations. Hales concludes that the law reflects a broader shift from traditional privacy-by-design frameworks toward a protective-by-design model focused on platform features and user safety, though the approach may face constitutional challenges similar to those confronting earlier state design codes…

     

    CONTINUE READING…