Nebraska's Age-Appropriate Online Design Code Act: LB 504, the LB 838 Rewrite and the First Lawsuit

Two Versions of the Act

Secondary accounts give the signing date as either May 30 or June 2, 2025. The LB 504 slip law settles it: "Approved by the Governor May 30, 2025." The bill was introduced by Senator Bosn "at the request of the Governor," adopted the Age-Appropriate Online Design Code Act in nine sections, and in Section 10 made the Act "operative on January 1, 2026."

The 2026 session rewrote much of it. LB 838, approved April 14, 2026, is an omnibus bill whose title runs from money transmitters to trust codes and ends with the design code. Sections 31 to 38 amend or add design code sections, and Section 40 makes them operative "three calendar months after the adjournment of this legislative session." The codified pages show that date as July 18, 2026 and the Act now spanning sections 87-1301 to 87-1311. This post describes the codified text in force today and notes where LB 838 changed the original.

What a Covered Online Service Is

As enacted, Section 2(5) of LB 504 required an entity to meet five conditions together: do business in Nebraska; determine the purposes and means of processing; exceed $25 million in annual gross revenue; annually buy, receive, sell or share personal data of 50,000 or more consumers, households or devices; and derive "at least fifty percent of its annual revenue from the sale or sharing of consumers' personal data." The last condition limited the original Act to businesses whose main revenue came from data.

LB 838 replaced that test. Section 87-1302(5)(a) now requires that the entity conduct business in Nebraska, "[g]enerates a majority of its annual revenue from online services," determine the purposes and means of processing, and satisfy "at least one" of two size tests: annual gross revenue over $25 million (adjusted every odd-numbered year for inflation), or annual processing of personal data of 50,000 or more consumers, households or devices, counting affiliates. Commonly branded affiliates and 40-percent owners of joint ventures are included.

Two exclusions apply. An online service with actual knowledge that fewer than 2 percent of its users are minors is outside the Act, and need not collect personal data to make that assessment. LB 838 added a second: financial institutions subject to Title V of the Gramm-Leach-Bliley Act. Online service itself excludes telecommunications services, broadband access, and "the sale, delivery, or use of a physical device." Section 87-1303 exempts government entities, GLBA, HITECH and HIPAA-regulated data, and clinical-trial information, and provides that where the Act conflicts with another law, "the law that affords the greatest protection from harm to minors shall control."

The Knowledge Standard

Most duties run to a "covered minor," defined as "a user that a covered online service knows to be a minor," meaning under 18. A user is someone who "registers an account or creates a profile," so the duties attach to account holders rather than anonymous visitors. To know means actual knowledge, and section 87-1302(1) defines actual knowledge broadly. It includes "all information and inferences known to the covered online service relating to the age of the individual," self-identified age, and "any age the covered online service has attributed or associated with the individual for any purpose, including marketing, advertising, or product development."

The same paragraph resolves conflicts between signals: if the service's marketing or advertising classification of a person differs from the age the person gave, the service "shall disregard self-identified age." Section 87-1305(2) states that a service is not required to collect personal data to comply, and that data collected for age verification "cannot" be used for other purposes. The original text also required deletion of age-verification data after use. LB 838 struck that requirement both there and in the 2 percent exclusion.

Covered Design Features, Before and After LB 838

A covered design feature is any feature that "will encourage or increase the frequency, time spent, or activity of a user." LB 504 listed five examples: infinite scroll, rewards for visit frequency or time spent, notifications or push alerts, in-game purchases, and appearance-altering filters. The amended list has eleven:

• Infinite scroll, or content that loads continuously beyond what the user asked for
• Auto-playing video or audio
• Quantification of engagement, such as visible counts of likes, comments, views or reactions
• Gamification, including streaks, badges and rewards
• "The use of clustering, timing, or volume of notifications or push alerts, irrespective of content"
• Virtual currencies or purchased digital items
• Image-altering filters or features creating a false perception of an image
• Requiring or repeatedly prompting account creation to see publicly available user content
• Ephemerality used to prompt urgent use
• Barriers to deleting an account or removing connections
• "A feature that increases usage through the illusion of talking with a human being that seeks to elicit feelings of intimacy from the user"

Section 87-1304(1) requires tools letting a covered minor limit who can contact them, hide their personal data, opt out of "all unnecessary covered design features," choose a chronological feed or block content categories from recommendation, limit in-app transactions, and restrict precise geolocation sharing. LB 838 removed the words that had tied these tools to covered design features, so they now apply generally.

Default Settings and Duties Toward Covered Minors

Section 87-1304(3) sets the safeguards' defaults "at the option or level that provides the highest protection available for the safety of the covered minor," and section 87-1305(8) applies the same rule to the data protections. Those protections limit collection and retention to what is needed for features the minor "has knowingly engaged" with, bar facilitating targeted advertising to a covered minor, require an obvious signal during geolocation collection and during parental monitoring, and confine profiling to what a requested service needs. Notifications are prohibited "between the hours of 10 p.m. and 6 a.m. and between the hours of 8 a.m. and 4 p.m. on week days during the school year."

Section 87-1306 requires parental tools, "enabled by default" for a known child under 13, to view and change account settings, restrict purchases, see total time spent and block use during set hours. Section 87-1307 requires harm-reporting mechanisms, and section 87-1308 bars advertising narcotics, tobacco, gambling and alcohol to covered minors and bars dark patterns. LB 838 added two sections. Section 87-1310 forbids a single setting that lowers every default at once, and prompts to weaken settings unless strictly necessary for a feature the minor expressly requested. Section 87-1311 requires a tool to unpublish or delete a covered minor's account, honored within 15 days.

Attorney General Enforcement and Its Start Date

Section 87-1309, unchanged by LB 838, makes any violation "additionally and separately" a deceptive trade practice under the Uniform Deceptive Trade Practices Act. Civil penalties are governed "exclusively" by subsection (3): "Beginning July 1, 2026," up to $50,000 for each violation, remitted to the State Treasurer under Article VII, section 5 of the Constitution. Subsection (1) bars the Attorney General from initiating an action to recover a civil penalty "until July 1, 2026." Each covered service must designate one or more officers responsible for compliance. The Act contains no cure period and no private right of action provision.

On October 14, 2026, the Attorney General announced a suit against OpenAI entities. The complaint, filed in Buffalo County District Court as Case No. D09CI260000488, pleads Count IX as a violation of the design code, alleging that each defendant meets the amended definition in section 87-1302(5) and listing fourteen alleged failures, from opt-out tools and default settings to push alerts "during prohibited hours." It seeks a declaration, an injunction and "civil penalties of $50,000 per violation" under section 87-1309(3). No ruling was located as of October 26, 2026.

No court challenge to the design code was located. The federal suit NetChoice v. Hilgers, No. 4:26-cv-03149 (D. Neb.), filed May 14, 2026, challenges the Parental Rights in Social Media Act, and its complaint does not cite the design code. Vermont's design code, which adds a duty of care that has no counterpart in Nebraska's text, is covered in the post on Act 63.

Frequently Asked Questions