Serves under-18s, in Nebraska

Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7) · Read the law's page

• This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
• Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.
• Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or HIPAA and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.

Neb. Rev. Stat. §§ 87-1301 to 87-1309 · Read the law's page

• Applies to online services with over $25 million in annual revenue that derive at least half their revenue from selling or sharing personal data, excluding services with actual knowledge that fewer than 2 percent of users are minors.
• Give minors accessible controls over addictive design features such as infinite scroll and push notifications.
• Default to the highest available privacy and safety settings for minors.
• Limit profiling and targeted advertising to minors.
• Restrict sharing of minors' precise geolocation data.

Neb. Rev. Stat. §§ 87-1301 to 87-1311, as amended · Read the law's page

• Approved by the Governor on April 14, 2026; the design code sections have been in force since 18 July 2026.
• Applies to a business that derives a majority of its annual revenue from online services and either has more than $25 million in annual revenue or processes the personal data of 50,000 or more consumers, households, or devices.
• If you meet this definition, you are a covered online service and the Age-Appropriate Online Design Code Act's duties for minors apply to you.
• Do not provide a covered minor with a single setting that makes all of the default privacy settings less protective at once, and do not request or prompt a covered minor to make privacy settings less protective unless the change is strictly necessary for the minor to access a service or feature the minor has expressly and unambiguously requested (section 87-1310).
• Provide a prominent, accessible, and responsive tool for a covered minor to request that the minor's account be unpublished or deleted, and honor the request no later than fifteen days after you receive it (section 87-1311).
• Do not use dark patterns (section 87-1308(2)).
• If you collect a user's personal data for age verification, do not use it for any other purpose (section 87-1305(2)).
• Treat each of the eleven features listed in section 87-1302(3) as a covered design feature when you provide the minor and parental tools and the notice that sections 87-1304 and 87-1306 require, including auto-playing video or audio, quantification of engagement, gamification, virtual currencies, image-altering filters, requiring or repeatedly prompting for account creation, and creating barriers to deleting an account.

2026 Neb. Laws LB 525, §§ 12-18 (109th Legislature, 2nd Session) · Read the law's page

• Clearly and conspicuously disclose to a minor account holder that they are interacting with artificial intelligence, either as a persistent visible disclaimer or at the start of every session and at least every three hours during a continuous interaction.
• Where a reasonable person interacting with the service could be misled into believing they are talking to a human, clearly and conspicuously disclose that it is artificial intelligence.
• Do not give minor account holders points or similar rewards at unpredictable intervals intended to increase their engagement with the service.
• Take reasonable measures to prevent the service from producing sexually explicit depictions, direct statements urging sexually explicit conduct, or sexually objectifying statements directed at a minor account holder.
• Take reasonable measures to prevent the service from claiming to be sentient or human, simulating emotional or romantic dependence, or role-playing an adult-minor romantic relationship with a minor account holder.
• Offer minor account holders, and their parents or guardians, tools to manage the account holder's privacy and account settings.
• Adopt a protocol for the service to respond to a user's suicidal-ideation or self-harm prompts, including reasonable efforts to refer the user to a crisis service.
• Do not knowingly and intentionally program the service to state that it is designed to provide professional mental or behavioral health care.
• The Attorney General, not a private plaintiff, enforces this Act.