Law / United States / 
Nebraska
LB 504 (2025), Age-Appropriate Online Design Code Act
Neb. Rev. Stat. §§ 87-1301 to 87-1309
In force since .
An age-appropriate design code rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to online services with over $25 million in annual revenue that derive at least half their revenue from selling or sharing personal data, excluding services with actual knowledge that fewer than 2 percent of users are minors.
- Give minors accessible controls over addictive design features such as infinite scroll and push notifications.no control in the NIST Privacy Framework
- Default to the highest available privacy and safety settings for minors.NIST Privacy FrameworkGV.PO-P2
- Limit profiling and targeted advertising to minors.NIST Privacy FrameworkCT.PO-P1
- Restrict sharing of minors' precise geolocation data.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalty up to $50,000 per violation as a deceptive trade practice; the Attorney General could not seek penalties until .
Who enforces it
Enforcement body
Nebraska Attorney General
Settledness
- As of
- Open questions
- Which age classifications used for marketing or advertising are 'inconsistent with the individual's self-identified age' under the definition of actual knowledge in section 2(1) of LB 504, so that a covered online service must disregard the self-identified age?
What it reaches
Age threshold
18
Covered services
Online services meeting revenue and personal data thresholds, excluding services with actual knowledge that fewer than 2 percent of users are minors.
How the hook was established
express
What makes it apply
Market targeting
What it makes you log
Log retention
Section 5(3) separately limits keeping a covered minor's personal data to what is necessary for the service the minor knowingly engaged.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal data collected for age verification, kept after its use for age verification
Logging duty
The act requires tools, default settings and design limits. It names no log, record or proof of the child's age, and its age verification clause bars other use of the data and requires deletion after use.
- Kind
- None
- As of
- Provision
- LB504 (2025) sections 4 and 5
What this law does
Requires a covered online service (over $25 million in annual revenue that derives at least half its revenue from selling or sharing personal data) to give minors accessible controls over addictive design features such as infinite scroll and push notifications, default to the highest available privacy and safety settings, limit profiling and targeted advertising to minors, and restrict sharing of precise geolocation data.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .