> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Nebraska’s Age-Appropriate Online Design Code: Privacy, Parental Controls, and Safer Defaults for Users Under 18
- URL: https://www.thedelatorrereview.com/nebraskas-age-appropriate-online-design-code-privacy-parental-controls-and-safer-defaults-for-users-under-18/
- Published: 2026-10-18T02:52:25.000Z
- Updated: 2026-10-18T02:52:25.000Z
- Description: Nebraska’s design code protects known users under 18 through data limits, safer defaults, parental tools, and restrictions on profiling, targeted ads, and engagement features—with penalties up to $50,000.
- Author: Lydia
- Tags: Children, Privacy Law, Dark Patterns, Advertising, Data Minimization, Purpose Limitation, Storage Limitation, Privacy by design / Data Protection by Design and by Default (Pbd), Nebraska

> **NOTE:** This article examines Nebraska’s Age-Appropriate Online Design Code Act, Neb. Rev. Stat. §§ 87-1301–87-1311, enacted through LB504 (2025) and amended by LB838 (2026). It incorporates the 2026 amendments and additions operative July 18, 2026, including provisions originating in LB1119 and enacted through LB838.

Nebraska’s Age-Appropriate Online Design Code Act regulates how covered online services collect and use minors’ data, design engagement features, configure defaults, and provide controls to young users and their parents.

The law combines data minimization and purpose limitation with concrete product requirements: controls over recommendations and purchases, restrictions on notifications, visible monitoring signals, and a fifteen-day deadline for requests to unpublish or delete an account. Its definition of a covered design feature expressly includes features that increase usage by creating the illusion of an intimate conversation with a human being.

The Act is codified at **Neb. Rev. Stat. §§** [**87-1301–87-1311**.](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1301&ref=thedelatorrereview.com) 

> **PRACTICE TIP:** Treat this as a product-design and data-governance law. A privacy notice alone cannot deliver protective defaults, usable controls, notification restrictions, or a functioning account-deletion process.

**Effective Date:** July, 2026 See Neb. Rev. Stat. [§ 87-1309(1), (3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1309&ref=thedelatorrereview.com)

**Relationship to other laws:** The Act’s requirements supplement other statutes, regulations, and Nebraska common law. 

- If laws conflict, the law providing the greatest protection from harm to minors controls.
- A violation also separately constitutes a deceptive trade practice, subject to the Act’s special treatment of civil penalties.

See §§ [87-1303(2)–(3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1303&ref=thedelatorrereview.com), [87-1309(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1309&ref=thedelatorrereview.com).

## Who Is Subject to the Act?

The principal obligations apply to a **covered online service**. The definition includes a sole proprietorship, limited liability company, corporation, association, or other legal entity that:

1. Conducts business in Nebraska;
2. Generates a majority of its annual revenue from online services;
3. Determines the purposes and means of processing consumers’ personal data, alone or jointly with affiliates, subsidiaries, or parent companies; and
4. Meets **at least one** of two thresholds: annual gross revenue exceeding $25 million, subject to the specified inflation adjustment, **or** annual processing of personal data relating to at least 50,000 consumers, households, or devices, alone or in combination with affiliates, subsidiaries, or parent companies.

The revenue amount is adjusted every odd-numbered year using the specified two-year Consumer Price Index measure and rounded up to the next $1,000\. The uploaded text supplies the statutory base amount rather than a separately published adjusted figure.

Coverage also extends to certain controlling or controlled entities sharing a name, service mark, or trademark that signals common ownership to a reasonable consumer. For a covered joint venture or partnership, a person with an ownership interest of at least 40% is included. 

See [§ 87-1302(5)(a)–(b)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Test the revenue and processing thresholds separately: the statute uses “or.” Also assess the majority-online-revenue condition and the corporate-group provisions. Company size alone does not resolve coverage.

## What Is Regulated?

### (1) Publicly Accessible Online Services

An **online service** is a service, product, or feature accessible to the public through the Internet, including a website or application. The definition reaches features as well as entire platforms. See [§ 87-1302(9).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com)

The individual protections generally attach to a **covered minor**: a user the service knows is **under 18**. A **child** **is under 13**. Importantly, a **user** is someone who registers an account or creates a profile on the service. These definitions matter when identifying the people to whom particular obligations apply. See § [87-1302(2), (4), (7)–(8), (18).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com)

**Actual knowledge includes information and inferences about age**, including self-identified age and ages attributed or associated with an individual for marketing, advertising, or product development. Where a marketing or advertising age classification conflicts with self-identified age, the service must disregard the self-identified age for purposes of the Act. See [§ 87-1302(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Review age-related information across the business. A service cannot assess knowledge solely by looking at the birthday entered during account creation while overlooking an inconsistent age classification used for advertising.

### (2) Engagement Features, Personal Data, and Profiling

A **covered design feature** **encourages or increases frequency of use, time spent, or user activity.** 

- The statutory examples include infinite scroll, autoplay, visible engagement counts, streaks and rewards, notification patterns, virtual currencies, image-altering filters, repeated account-creation prompts, urgency created by disappearing content, and barriers to deleting accounts or removing connections.
- The list also includes **a feature that increases usage through the illusion of talking with a human being and seeks to elicit feelings of intimacy**. This is a functional description: the relevant question is what the feature does, rather than whether the provider calls it a companion chatbot.

See [§ 87-1302(3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com).

**Personal data** means *"any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household."*  Publicly available data is excluded. See [§ 87-1302(11),(16)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com)

**Profiling** means automated processing to *"evaluate, analyze, or predict"* aspects of a covered minor, including economic situation, health, preferences, interests, reliability, behavior, location, or movements. See [§ 87-1302(15)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com)

### (3) Exclusions and Exemptions

The covered-service definition excludes an online service with **actual knowledge that fewer than 2% of its users are minors**. The service need not collect personal data to make that assessment. If it does collect data for the assessment, it cannot use the data for other purposes. The definition also excludes financial institutions subject to Title V of the Gramm-Leach-Bliley Act or its implementing regulations. See [§ 87-1302(5)(c).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com)

The online-service definition excludes telecommunications services, broadband Internet access services, and the sale, delivery, or use of a physical device. Section 87-1303 separately excludes government entities acting in the ordinary course of operations, specified data subject to GLBA or the identified federal health-information frameworks, and information collected in qualifying clinical trials. See §§ [87-1302(9)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), [87-1303(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1303&ref=thedelatorrereview.com).

> **PRACTICE TIP:** An adult-audience label does not establish actual knowledge that fewer than 2% of users are minors. Distinguish entity exclusions from data-specific exemptions, and assess an associated app or website separately from the physical device it supports.

## Individual Rights and Business Obligations

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/10/Nebraska-Online-Design-Code-Guide.png)

### (1) Use Age Information Appropriately and Limit Verification Data

The Act does not require a service to collect users’ personal data to comply. When a service collects data for age verification, it cannot use that data for other purposes. These restrictions operate alongside the actual-knowledge definition and the separate limits on data collected to establish the under-2% exclusion. See §§ [87-1302(1), (5)(c)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), [87-1305(2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Separate the question of what the service already knows about age from the question of whether to collect additional verification data. Do not describe the Act as universally requiring government identification or as supplying California’s age-estimation-or-universal-protections alternative.

### (2) Protective Defaults and Limits on Privacy Downgrades

The safeguards in [§ 87-1304(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com) must default to the option or level providing the highest available protection for a covered minor’s safety. [Section 87-1305](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com) similarly requires the highest protective defaults for its protections.

A service cannot offer a single setting that makes all default privacy settings less protective at once. Nor may it request or prompt a covered minor to weaken privacy settings unless the change is strictly necessary to access a service or feature the minor expressly and unambiguously requested. See §§ [87-1304(3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com), [87-1305(8)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com), [87-1310](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1310&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Review onboarding defaults and later prompts together. A protective starting configuration can be undermined by repeated requests to relax it.

### (3) Accessible Controls Over Contact, Visibility, and Engagement

Covered minors must receive accessible, easy-to-use tools to limit communications from other users or visitors, prevent others from viewing their personal data, and opt out of unnecessary design features or categories of unnecessary covered design features. See § [87-1304(1)(a)–(c)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Inventory engagement features and identify which are necessary to provide the service. Include conversational intimacy features in that inventory alongside feeds, streaks, and notifications.

### (4) Controls Over Recommendations, Purchases, and Time Spent

A **personalized recommendation system is a fully or partially automated system suggesting, promoting, or ranking content**—including users, hashtags, or posts—based on users’ personal data. Covered minors must be able to control these systems by opting into a **chronological feed** or **preventing categories** of content from being recommended. See §§ [87-1302(12)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), [87-1304(1)(d).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com)

They must also have tools to opt out of in-game purchases and other transactions or place limits on them, and accessible, easy-to-use options to limit time spent on the service. See § [87-1304(1)(e), (2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Verify that the controls change the product experience. A settings page describing recommendations or screen time does not itself provide a usable way to control them.

### (5) Data Minimization, Purpose Limitation, and Retention

A service may collect and use **only the minimum** personal data **necessary** to provide the specific elements with which a covered minor has knowingly engaged. The data c**annot be used for reasons other than those for which it was collected**, and it may be **retained only as long as necessary** to provide those specific elements. See § [87-1305(1), (3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com).

- These requirements reflect three familiar GDPR principles: **data minimization** limits how much data is processed, **purpose limitation** restricts what it is used for, and **storage limitation** governs how long it is kept. See the additional resources section for articles on what these principles mean.

> **PRACTICE TIP:** Map collection, use, and retention to the particular feature the minor knowingly uses. A general reference to improving the platform does not identify that feature or establish the necessity of each data practice.

### (6) Restrictions on Profiling

A service **cannot profile** a covered minor **unless** profiling is **necessary** to provide a service the minor requested, and only with respect to the aspects with which the minor is actively and knowingly engaged. The provision is not limited to default profiling. See §§ [87-1302(15)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), [87-1305(7)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Identify the requested function, why profiling is necessary for it, and the aspects the minor actually uses. An opt-in alone does not establish the statutory necessity.

### (7) Targeted Advertising and Prohibited Products

The Act **prohibits facilitating targeted advertising to covered minors**. Its definition focuses on advertisements selected using personal data obtained or inferred from activity over time and across nonaffiliated websites or apps.

- The definition excludes advertising based on activity within the service’s own websites or apps, contextual advertising, advertisements responding to a request for information or feedback, and processing solely to measure or report advertising frequency, performance, or reach. Those exclusions define this particular prohibition; other data and design restrictions still apply. See §§ [87-1302(17)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), [87-1305(4)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com).

A separate provision **prohibits facilitating advertisements for prohibited products**, with examples including narcotic drugs, tobacco products, gambling, and alcohol, to covered minors. See § [87-1308(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1308&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Review how an advertisement is selected and what it promotes. An ad outside the targeted-advertising definition may still fall within the prohibited-products rule.

### (8) Precise Geolocation and Visible Monitoring Signals

Covered minors must receive **tools restricting the sharing of precise geolocation and notice** concerning its tracking. An obvious sign must appear when precise geolocation is collected or used. If parental monitoring is allowed, the service must provide an obvious signal while the minor is being monitored. See §§ [87-1304(1)(f)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com), [87-1305(5), (9).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com)

The **precise-geolocation definition uses a 1,750-foot radius** and covers specified information identifying a minor’s or linked device’s present or past location. It excludes communications content and specified advanced utility-metering data. See § [87-1302(13).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com)

> **PRACTICE TIP:** Treat controls, notices, and live signals as distinct requirements. Nebraska’s precise-geolocation definition uses a **1,750-foot radius**, compared with **1,850 feet under the CCPA** (Cal. Civ. Code § [1798.140(w)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=1798.140.&lawCode=CIV&ref=thedelatorrereview.com)). A location control does not establish that collection is necessary under the separate minimization rule.

### (9) Notification and Push-Alert Restrictions

Section [87-1305(6)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com) prohibits notifications and push alerts to covered minors between **10 p.m. and 6 a.m.**, and between **8 a.m. and 4 p.m. on weekdays during the school year**, using the minor’s local time zone.

> **PRACTICE TIP:** Test delivery scheduling against local time and school-year conditions. The statutory restriction is separate from any additional limits a parent chooses.

### (10) Parental Tools and Notice to Minors

Services must **provide parental tools** to protect and support minors using covered design features. The tools must be enabled by default for an individual the service knows is a **child under 13**.

- The detailed provisions distinguish children from minors.
- Parents must be able to view and manage a child’s privacy and account settings, restrict a minor’s purchases and financial transactions, and view and reasonably limit a child’s time on the service, including at parent-specified times such as school hours and nighttime.
- Covered minors must be notified when these tools operate and told which settings apply.

See § [87-1306.](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1306&ref=thedelatorrereview.com)

> **PRACTICE TIP:** Preserve the statute’s age distinctions. Purchase restrictions address minors, while several account-management and time-control provisions expressly refer to children under 13.

### (11) Reporting Harms and Unpublishing or Deleting Accounts

Services must establish **mechanisms** for covered minors and parents **to report harms**. They must also provide covered minors with a prominent, accessible, responsive tool to request that an account be **unpublished or deleted**, and honor the request within **fifteen days** of receipt. See §§ [87-1307](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1307&ref=thedelatorrereview.com), [87-1311](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1311&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Track the fifteen-day deadline from receipt. The account provision should not be described as an express requirement to erase every associated record within fifteen days; personal-data retention is addressed separately in § 87-1305(3).

### (12) Dark Patterns

The Act **prohibits covered online services from using dark patterns**. The definition addresses interfaces designed or manipulated with the effect of substantially subverting or impairing user autonomy, decisionmaking, or choice, and includes practices the Federal Trade Commission determines are dark patterns. See §§ [87-1302(6)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), [87-1308(2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1308&ref=thedelatorrereview.com).

- Nebraska’s definition closely tracks the CCPA’s focus on interfaces that substantially undermine autonomy, decisionmaking, or choice. However, Nebraska expressly includes practices determined to be dark patterns by the FTC, while the CCPA provides for further definition through California regulations. See Cal. Civ. Code § [1798.140(l)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=1798.140.&lawCode=CIV&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Review the interface as a whole: repeated prompts, hidden exits, cancellation barriers, and unequal choice presentation. Section 87-1308(2) does not expressly confine its prohibition to privacy choices or interactions with covered minors.

### (13) A Designated Officer Responsible for Compliance

Each covered service must designate one or more officers responsible for compliance with the Act. See § [87-1309(2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1309&ref=thedelatorrereview.com).

> **PRACTICE TIP:** Give the designated officer a process for obtaining evidence from product, engineering, advertising, privacy, and customer-support teams. Many obligations depend on how features operate in practice.

## Sanctions and Remedies

### (1) Civil Penalties and Deceptive-Trade-Practice Consequences

Beginning July 1, 2026, a covered service violating the Act may face a civil penalty of up to **$50,000 for each violation**. The Act does not express this maximum as a per-child amount. See § [87-1309(3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1309&ref=thedelatorrereview.com).

- A violation additionally and separately constitutes a deceptive trade practice under Nebraska’s Uniform Deceptive Trade Practices Act. See § [87-1309(1), (3).](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1309&ref=thedelatorrereview.com)

> **PRACTICE TIP:** Distinguish the Design Code’s penalty provision from liability arising independently under another law. Do not assume that calling a Design Code violation a deceptive trade practice automatically creates an additional civil-penalty amount.

---

> **The supplied text does not expressly create a standalone private right of action under the Design Code, nor does it contain California’s express prohibition on using the chapter as the basis for a private action.** 

---

## Additional Resources

### Legislation and Official Materials

The following links are the official statutory URLs identified in the supplied Nebraska materials:

- [Section 87-1301 — Act, how cited](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1301&ref=thedelatorrereview.com).
- [Section 87-1302 — Definitions](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1302&ref=thedelatorrereview.com), including coverage, age knowledge, design features, and targeted advertising.
- [Section 87-1303 — Applicability](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1303&ref=thedelatorrereview.com), exemptions, and interaction with other laws.
- [Section 87-1304 — Safeguards](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1304&ref=thedelatorrereview.com), user controls, and protective defaults.
- [Section 87-1305 — Personal-data collection and use](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1305&ref=thedelatorrereview.com), profiling, advertising, notifications, and monitoring.
- [Section 87-1306 — Parental tools](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1306&ref=thedelatorrereview.com) and notification to minors.
- [Section 87-1307 — Reporting harms](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1307&ref=thedelatorrereview.com).
- [Section 87-1308 — Prohibited advertisements and dark patterns](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1308&ref=thedelatorrereview.com).
- [Section 87-1309 — Enforcement, responsible officers, and penalties](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1309&ref=thedelatorrereview.com).
- [Section 87-1310 — Privacy-setting downgrades](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1310&ref=thedelatorrereview.com).
- [Section 87-1311 — Requests to unpublish or delete accounts](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1311&ref=thedelatorrereview.com).

### Related Reading in The de la Torre Review

- [**California’s Age-Appropriate Design Code Gets a Rewrite: New Privacy Rules for Users Under 18**](https://www.thedelatorrereview.com/californias-age-appropriate-design-code-gets-a-rewrite-new-privacy-rules-for-users-under-18/)— Explains California’s replacement framework, including its coverage, age-assurance approach, privacy restrictions, and remedies.
- [**What Is “Data Minimization” Under the GDPR?**](https://www.thedelatorrereview.com/what-is-data-minimization-under-the-gdpr/) — Explains how necessity, relevance, and adequacy determine the amount of personal data an organization should process.
- [**What Does “Purpose Limitation” Mean Under the GDPR?**](https://www.thedelatorrereview.com/what-does-purpose-limitation-mean-under-the-gdpr/) — Examines specifying processing purposes and the conditions governing later uses, providing context for Nebraska’s restriction on repurposing minors’ data.
- [**What Does “Storage Limitation” Mean Under the GDPR?**](https://www.thedelatorrereview.com/what-does-storage-limitation-mean-under-the-gdpr/) — Discusses purpose-based retention periods, deletion, and anonymization, providing practical background for assessing when personal data is no longer needed.

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/10/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-17.png)