Law / United States / 
Nebraska
LB 838 (2026), amendments to the Age-Appropriate Online Design Code Act
Neb. Rev. Stat. §§ 87-1301 to 87-1311, as amended
In force since .
An age-appropriate design code rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Audit expectation
- none
What it requires
- Approved by the Governor on ; the design code sections have been in force since .
- Applies to a business that derives a majority of its annual revenue from online services and either has more than $25 million in annual revenue or processes the personal data of 50,000 or more consumers, households, or devices.
- If you meet this definition, you are a covered online service and the Age-Appropriate Online Design Code Act's duties for minors apply to you.
- Do not provide a covered minor with a single setting that makes all of the default privacy settings less protective at once, and do not request or prompt a covered minor to make privacy settings less protective unless the change is strictly necessary for the minor to access a service or feature the minor has expressly and unambiguously requested (section 87-1310).NIST Privacy FrameworkCT.PO-P3
- Provide a prominent, accessible, and responsive tool for a covered minor to request that the minor's account be unpublished or deleted, and honor the request no later than fifteen days after you receive it (section 87-1311).NIST Privacy FrameworkCT.PO-P3
- Do not use dark patterns (section 87-1308(2)).no control in the NIST Privacy Framework
- If you collect a user's personal data for age verification, do not use it for any other purpose (section 87-1305(2)).NIST Privacy FrameworkCT.PO-P1
- Treat each of the eleven features listed in section 87-1302(3) as a covered design feature when you provide the minor and parental tools and the notice that sections 87-1304 and 87-1306 require, including auto-playing video or audio, quantification of engagement, gamification, virtual currencies, image-altering filters, requiring or repeatedly prompting for account creation, and creating barriers to deleting an account.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What counts as 'creating barriers to deleting an account or to removing connections to other users of the service' in the definition of covered design feature in Neb. Rev. Stat. 87-1302(3)(j), such as an extra confirmation step, a waiting period or a required support request?
What it makes you log
Log retention
This is a general limit on a covered minor's personal data, not a rule about records of an age check.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- A covered minor's personal data, kept longer than necessary to provide the specific elements of the online service the minor knowingly engaged
Logging duty
The codified act requires tools, default settings and design limits. It names no log, record or proof of the child's age. Section 87-1305(2) bars other use of data collected for age verification; the deletion sentence of LB504 section 5(2) does not appear in the codified text read.
- Kind
- None
- As of
- Provision
- Neb. Rev. Stat. 87-1304 and 87-1305, as amended by LB838 (2026)
What this law does
LB 838 was approved by the Governor on . The sections of LB 838 that change the Act became operative three calendar months after the adjournment of the legislative session.
The definitions in section 87-1302 are operative as amended from . As amended, a covered online service is a business that conducts business in Nebraska, generates a majority of its annual revenue from online services, determines the purposes and means of processing consumers' personal data, and either has annual gross revenue above $25 million or annually processes the personal data of 50,000 or more consumers, households, or devices.
Until , the test required annual gross revenue above $25 million, annual purchase, receipt, sale or sharing of the personal data of 50,000 or more consumers, households, or devices, and at least 50 percent of annual revenue from the sale or sharing of personal data.
As amended, a covered design feature includes eleven listed features, among them infinite scroll, auto-playing video or audio, quantification of engagement, gamification, virtual currencies, and barriers to deleting an account. Until , a covered design feature included five listed features: infinite scroll, rewards or incentives for frequency of visits or time spent, notifications or push alerts, in-game purchases, and appearance-altering filters.
As amended, the definition of a covered online service also excludes a financial institution subject to Title V of the Gramm-Leach-Bliley Act or any regulations adopted in accordance with that act.
Section 87-1304, as amended, is operative from . As amended, section 87-1304(1) requires a covered online service to provide each covered minor with accessible and easy-to-use tools that limit who can communicate with the minor, prevent others from viewing the minor's personal data, and control design features, personalized recommendations, purchases and the sharing of precise geolocation information.
Until , the lead-in to that subsection described tools that accomplish the following with respect to covered design features.
Section 87-1305, as amended, is operative from . As amended, section 87-1305(2) provides that a covered online service that collects personal data of a user for age verification cannot use that data for other purposes. Until , such a service also had to delete that personal data after use for age verification.
From , section 87-1306(2) requires a covered online service to provide parents the listed abilities for an individual it knows to be a child or minor, and section 87-1306(3) requires it to notify a covered minor when any of the tools described in that section are in effect. Until , section 87-1306(2) opened with the words with respect to covered design features, and section 87-1306(3) required notice of a covered design feature when any of the tools were in effect.
From , section 87-1308(2) prohibits a covered online service from using dark patterns. Until , section 87-1308(2) prohibited using dark patterns to subvert or impair covered minor autonomy, decision-making, or choice.
Section 87-1310, added by LB 838 and operative from , prohibits a covered online service from providing a covered minor with a single setting that makes all of the default privacy settings less protective at once, and from requesting or prompting a covered minor to make privacy settings less protective unless the change is strictly necessary for a service or feature the minor has expressly and unambiguously requested.
Section 87-1311, also added by LB 838 and operative from , requires a covered online service to provide a prominent, accessible, and responsive tool for a covered minor to request that the minor's account be unpublished or deleted, and to honor the request no later than fifteen days after receiving it.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .