Operates a social platform, in Nebraska

Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7) · Read the law's page

• This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
• Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.
• Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or HIPAA and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.

Neb. Rev. Stat. §§ 87-1301 to 87-1309 · Read the law's page

• Applies to online services with over $25 million in annual revenue that derive at least half their revenue from selling or sharing personal data, excluding services with actual knowledge that fewer than 2 percent of users are minors.
• Give minors accessible controls over addictive design features such as infinite scroll and push notifications.
• Default to the highest available privacy and safety settings for minors.
• Limit profiling and targeted advertising to minors.
• Restrict sharing of minors' precise geolocation data.

Neb. Rev. Stat. §§ 86-1701 to 86-1705 · Read the law's page

• Verify the age of prospective account holders on your social media platform using a reasonable age verification method.
• Obtain a parent's express, verified consent before a minor may hold an account.
• Give parents tools to view a minor's messages, control privacy settings, and limit time on the platform; the requirement to give parents access to a minor's posts, interactions, and messages was not enjoined.

Neb. Rev. Stat. §§ 87-1301 to 87-1311, as amended · Read the law's page

• Approved by the Governor on April 14, 2026; the design code sections have been in force since 18 July 2026.
• Applies to a business that derives a majority of its annual revenue from online services and either has more than $25 million in annual revenue or processes the personal data of 50,000 or more consumers, households, or devices.
• If you meet this definition, you are a covered online service and the Age-Appropriate Online Design Code Act's duties for minors apply to you.
• Do not provide a covered minor with a single setting that makes all of the default privacy settings less protective at once, and do not request or prompt a covered minor to make privacy settings less protective unless the change is strictly necessary for the minor to access a service or feature the minor has expressly and unambiguously requested (section 87-1310).
• Provide a prominent, accessible, and responsive tool for a covered minor to request that the minor's account be unpublished or deleted, and honor the request no later than fifteen days after you receive it (section 87-1311).
• Do not use dark patterns (section 87-1308(2)).
• If you collect a user's personal data for age verification, do not use it for any other purpose (section 87-1305(2)).
• Treat each of the eleven features listed in section 87-1302(3) as a covered design feature when you provide the minor and parental tools and the notice that sections 87-1304 and 87-1306 require, including auto-playing video or audio, quantification of engagement, gamification, virtual currencies, image-altering filters, requiring or repeatedly prompting for account creation, and creating barriers to deleting an account.