Text of NE LB 504 (2025)
Adopt the Age-Appropriate Online Design Code Act
Legislative text is a public record. Where LegiScan supplied it, the CC BY 4.0 credit applies.
Source: LegiScan. Bill data and text from LegiScan (legiscan.com), licensed CC BY 4.0 and used in modified form. LegiScan does not endorse the Trans Data Initiative. License: CC BY 4.0(opens another site). Source page(opens another site)
As introduced
23,645 characters
LEGISLATURE OF NEBRASKA
ONE HUNDRED NINTH LEGISLATURE
FIRST SESSION
LEGISLATIVE BILL 504
Introduced by Bosn, 25; at the request of the Governor; Ballard, 21;
Bostar, 29; Prokop, 27.
Read first time January 21, 2025
Committee:
A BILL FOR AN ACT relating to consumer protections; to adopt the Age-
1
Appropriate Online Design Code Act; to provide an operative date;
2
and to provide severability.
3
Be it enacted by the people of the State of Nebraska,
4
LB504
2025
LB504
2025
-1-
Section 1. Sections 1 to 12 of this act shall be known and may be
1
cited as the Age-Appropriate Online Design Code Act.
2
Sec. 2. For purposes of the Age-Appropriate Online Design Code Act:
3
(1) Actual knowledge includes all information and inferences known
4
to the covered online service relating to the age of the individual,
5
including, but not limited to, self-identified age, and any age the
6
covered online service has attributed or associated with the individual
7
for
any
purpose,
including
marketing,
advertising,
or
product
8
development;
9
(2) Child or children means an individual or individuals younger
10
than thirteen years of age;
11
(3) Compulsive usage means the persistent and repetitive use of a
12
covered online service that substantially limits one or more major life
13
activities of a user, including sleeping, eating, learning, reading,
14
concentrating, communicating, or working;
15
(4) Covered design feature means any feature or component of a
16
covered online service that will encourage or increase the frequency,
17
time spent, or activity of a user on the covered online service and
18
includes, but is not limited to:
19
(a) Infinite scroll;
20
(b) Rewards or incentives for frequency of visits or time spent on
21
the covered online service;
22
(c) Notifications or push alerts;
23
(d) In-game purchases; or
24
(e) Appearance altering filters;
25
(5)(a) Covered online service means a sole proprietorship, a limited
26
liability company, a corporation, an association, or any other legal
27
entity that owns, operates, controls, or provides an online service that:
28
(i) Conducts business in this state;
29
(ii) Is reasonably likely to be accessed by minors;
30
(iii) Alone, or jointly with its affiliates or subsidiaries or
31
LB504
2025
LB504
2025
-2-
parent companies, determines the purposes and means of the processing of
1
consumers' personal data; and
2
(iv) Either:
3
(A) Has annual gross revenue in excess of twenty-five million,
4
adjusted every odd-numbered year to reflect changes in the Consumer Price
5
Index;
6
(B) Annually buys, receives, sells, or shares the personal data of
7
fifty thousand or more consumers, households, or devices, alone or in
8
combination with its affiliates or subsidiaries; or
9
(C) Derives at least fifty percent of its annual revenue from the
10
sale or sharing of consumers' personal data.
11
(b) A covered online service includes:
12
(i) An entity that controls or is controlled by a business that
13
shares a name, service mark, or trademark that causes a reasonable
14
consumer to understand that two or more entities are commonly owned; and
15
(ii) A joint venture or partnership composed of businesses in which
16
each has at least a forty percent interest in the joint venture or
17
partnership;
18
(6) Known to be a minor means actual knowledge that the covered
19
online service is reasonably likely to be accessed by minors;
20
(7) Minor means an individual younger than eighteen years of age;
21
(8) Online service means any service, product, or feature that is
22
accessible to the public via the Internet, including a website or
23
application. An online service includes a digital service, product, or
24
feature that is based in whole or in part on artificial intelligence. An
25
online service does not include any of the following:
26
(a) A telecommunications service as defined in 47 U.S.C. 153;
27
(b) A broadband internet access service as defined in 47 C.F.R.
28
8.1(b); or
29
(c) The sale, delivery, or use of a physical device;
30
(9) Parent has the same meaning as in the federal Children's Online
31
LB504
2025
LB504
2025
-3-
Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., and the Federal
1
Trade Commission rules implementing such act;
2
(10) Personal data means any information, including derived data and
3
unique identifiers, that is linked or reasonably linkable, alone or in
4
combination with other information, to an identified or identifiable
5
individual or to a device that identifies, is linked to, or is reasonably
6
linkable to one or more identified or identifiable individuals in a
7
household. Personal data does not include publicly available data;
8
(11) Personalized recommendation system means a fully or partially
9
automated system used to suggest, promote, or rank content, including
10
other users, hashtags, or posts, based on the personal data of users;
11
(12) Precise geolocation information means any data that identifies
12
within a radius of one thousand eight hundred fifty feet a user's present
13
or past location or the present or past location of a device that links
14
or is linkable to a user or any data that is derived from a device that
15
is used or intended to be used to locate a user within a radius of one
16
thousand eight hundred fifty feet by means of technology that includes a
17
global
positioning
system
that
provides
latitude
and
longitude
18
coordinates. Precise geolocation information does not include the content
19
of communications or any data generated or connected to advanced utility
20
metering infrastructure systems or equipment for use by a utility;
21
(13) Process means to perform an operation or set of operations by
22
manual or automated means on personal data. Process includes collecting,
23
using, storing, disclosing, sharing, analyzing, deleting, or modifying
24
personal data;
25
(14) Profile means any form of automated processing of personal data
26
to evaluate, analyze, or predict certain aspects relating to a user,
27
including a user's economic situation, health, personal preferences,
28
interests, reliability, behavior, location, or movements;
29
(15) Publicly available data means data (a) that is lawfully made
30
available from federal, state, or local government records, (b) that a
31
LB504
2025
LB504
2025
-4-
business has a reasonable basis to believe is lawfully made available to
1
the general public by the individual or from widely distributed media, or
2
(c) that is made available by a person to whom the individual has
3
disclosed the data if the individual has not restricted the data to a
4
specific audience. Publicly available data does not mean biometric data
5
collected by a covered online service about a user without the user's
6
knowledge;
7
(16) Reasonably likely to be accessed by minors means:
8
(a) It is reasonable to expect that the covered online service would
9
be accessed by an individual minor or by minors, based on satisfying
10
either of the following criteria:
11
(b) The covered online service has actual knowledge that a
12
particular consumer is a minor; or
13
(c) The covered online service is directed to children;
14
(17) Sensitive personal data means personal data that reveals:
15
(a) An individual's social security, driver's license, state
16
identification card, or passport number;
17
(b) An individual's account log-in, financial account, debit card,
18
or credit card number in combination with any required security or access
19
code, password, or credentials allowing access to an account;
20
(c) An individual's precise geolocation information;
21
(d) An individual's racial or ethnic origin, citizenship or
22
immigration status, religious or philosophical beliefs, or union
23
membership;
24
(e) The contents of an individual's mail, email, text messages, or
25
other forms of communications that perform similar functions, including
26
shared images and videos, unless the business is the intended recipient
27
of the communication;
28
(f) An individual's genetic data;
29
(g)
Biometric
data
that
uniquely
identifies
an
individual,
30
including,
but
not
limited
to,
personal
images
or
physical
31
LB504
2025
LB504
2025
-5-
characteristics;
1
(h) Personal data concerning an individual's health; or
2
(i) Personal data revealing sex, sex life, sexual orientation,
3
gender, or gender identity;
4
(18) Targeted advertising means displaying advertisements to an
5
individual where the advertisement is selected based on personal data
6
obtained or inferred from that individual's activities over time and
7
across nonaffiliated websites or online applications to predict the
8
individual's preferences or interest. Targeted advertising does not
9
include:
10
(a) Advertisements based on activities within a covered online
11
service's own Internet websites or online applications;
12
(b) Advertisements based on the context of an individual's current
13
search query, visit to an Internet website, or use of an online
14
application;
15
(c) Advertisements directed to an individual in response to the
16
individual's request for information or feedback; or
17
(d) Processing personal data solely to measure or report advertising
18
frequency, performance, or reach; and
19
(19) User means, with respect to a covered online service, an
20
individual who registers an account or creates a profile on the covered
21
online service.
22
Sec. 3. (1) The Age-Appropriate Online Design Code Act does not
23
apply to:
24
(a) A federal, state, tribal, or local government entity in the
25
ordinary course of its operations;
26
(b) Personal data subject to a statute or regulation that is
27
controlled by a covered online service that is required to comply with:
28
(i) Title V of the federal Gramm-Leach-Bliley Act;
29
(ii) The federal Health Information Technology for Economic and
30
Clinical Health Act; or
31
LB504
2025
LB504
2025
-6-
(iii) Regulations promulgated under section 264 of the Health
1
Insurance Portability and Accountability Act of 1996; and
2
(c) Information, including, but not limited to, personal data,
3
collected as part of a clinical trial subject to the federal policy for
4
the protection of human subjects in accordance with:
5
(i) Good clinical practice guidelines issued by the International
6
Council for Harmonization of Technical Requirements for Pharmaceuticals
7
for Human Use; or
8
(ii) Human subject protection requirements of the federal Food and
9
Drug Administration.
10
(2) The requirements of the Age-Appropriate Online Design Code Act
11
are in addition to and shall not limit or restrict in any way the
12
application of other laws, including, but not limited to, statutes, rules
13
and regulations, and the common law of Nebraska.
14
(3) In the event of a conflict between the Age-Appropriate Online
15
Design Code Act and one or more other laws, the law that affords the
16
greatest protection from harm to minors shall control.
17
Sec. 4. (1) Except as provided in subsections (2) and (3) of this
18
section, a covered online service is required to exercise reasonable care
19
in the use of personal data of a user and in the design and
20
implementation of such covered online service, including, but not limited
21
to, covered design features, to prevent the following harms:
22
(a) Compulsive usage of the covered online service;
23
(b) Severe psychological harm, including but not limited to anxiety
24
and depression;
25
(c) Severe emotional distress;
26
(d) Highly offensive intrusions on reasonable privacy expectations;
27
(e) Identity theft;
28
(f) Discrimination on the basis of race, ethnicity, sex, disability,
29
sexual orientation, gender identity, gender expression, or national
30
origin; and
31
LB504
2025
LB504
2025
-7-
(g) Material financial or physical injury.
1
(2) Harms described in subsection (1) of this section are limited to
2
those for which liability is permitted under 47 U.S.C. 230.
3
(3) Nothing in this section shall be construed to require a covered
4
online service to prevent or preclude any user from deliberately and
5
independently searching for or specifically requesting content, or
6
accessing
resources
and
information
regarding
the
prevention
or
7
mitigation of the harms described in this section.
8
Sec. 5. (1) A covered online service shall provide users with
9
accessible and easy-to-use tools that accomplish the following:
10
(a) Limit the ability of other users or visitors to communicate with
11
the user;
12
(b) Prevent other individuals from viewing the personal data of the
13
user;
14
(c) Prevent artificial intelligence from utilizing personal data to
15
communicate or interact with the user;
16
(d) Control the operation of all design features, including, but not
17
limited to, all covered design features, that are unnecessary in order to
18
provide the covered online service by allowing users to opt out of the
19
use of all design features or categories of design features;
20
(e) Control personalized recommendation systems by allowing users to
21
opt in to a chronological feed or by preventing categories of content
22
from being recommended;
23
(f) Control the use of in-game purchases or other transactions by
24
allowing users to opt out of all such purchases and transactions or to
25
place limits on such purchases and transactions; and
26
(g) Restrict the sharing of the precise geolocation information of
27
the user and provide notice regarding tracking of the user's precise
28
geolocation information.
29
(2) A covered online service shall provide a user with accessible
30
and easy to use options to limit the amount of time the user spends on
31
LB504
2025
LB504
2025
-8-
the covered online service.
1
(3) A covered online service shall establish default settings
2
applicable to an individual the covered online service knows is a minor
3
for the safeguards described in subsection (1) of this section at the
4
option or level that provides the highest protection available for the
5
safety of the individual.
6
Sec. 6. (1) A covered online service shall only collect and use the
7
minimum amount of a user's personal data necessary to provide the
8
specific elements of an online service with which a user has knowingly
9
engaged. Such personal data may not be used for reasons other than those
10
for which it was collected.
11
(2) A covered online service that collects personal data of a user
12
for age verification or estimation cannot use such personal data for
13
other purposes and shall delete such personal data after use for age
14
verification.
15
(3) A covered online service shall only retain the personal data of
16
a user as long as necessary to provide the specific elements of an online
17
service with which a user has knowingly engaged.
18
(4) A covered online service may not facilitate targeted advertising
19
to an individual the covered online service knows is a minor.
20
(5) A covered online service shall provide an obvious sign to a user
21
when precise geolocation information is being collected or used.
22
(6) The use of notifications and push alerts to an individual the
23
covered online service knows is a minor is prohibited between the hours
24
of 10 p.m. and 6 a.m. and between the hours of 8 a.m. and 4 p.m. on week
25
days during the school year in the minor's local time zone.
26
(7) A covered online service shall not profile an individual the
27
covered online service knows is a minor unless profiling is necessary to
28
provide a covered online service requested by such minor, and only with
29
respect to the aspects of the covered online service with which a minor
30
is actively and knowingly engaged.
31
LB504
2025
LB504
2025
-9-
(8) A covered online service shall ensure that settings for the
1
protections required pursuant to this section are set at the highest
2
protection available for the safety of the individual by default.
3
(9) If a covered online service allows parental monitoring, the
4
covered online service shall provide an obvious signal to the user when
5
such user is being monitored.
6
Sec. 7. (1) A covered online service shall treat all users of a
7
covered online service as a minor unless the covered online service has
8
actual knowledge that the user is not a minor.
9
(2) A covered online service shall provide parents with tools to
10
help parents protect and support minors using the covered online
11
services. Such parental tools shall be on by default for an individual
12
the covered online service knows is a child.
13
(3) A covered online service shall provide parents the ability to do
14
the following for an individual the covered online service knows is a
15
child or minor, as applicable:
16
(a) Manage the child's privacy and account settings in a manner that
17
allows parents to:
18
(i) View the child's account settings; and
19
(ii) Change and control privacy and account settings of the child;
20
(b) Restrict purchases and financial transactions of the minor; and
21
(c) Enable parents to view the total time spent on a covered online
22
service by a user the covered online service knows is a child and place
23
reasonable limits on such child's use of the covered online service.
24
Among such protections, a covered online service shall offer parents the
25
ability to restrict a child's use of the covered online service during
26
times of day specified by the parents, including during school hours and
27
at night.
28
(4) A covered online service shall notify a user when any of the
29
tools described in this section are in effect and describe what settings
30
have been applied.
31
LB504
2025
LB504
2025
-10-
Sec. 8. A covered online service shall establish mechanisms to
1
report harms to minors on covered online services.
2
Sec. 9. (1) A covered online service is prohibited from
3
facilitating ads for prohibited products, such as narcotic drugs, tobacco
4
products, gambling, and alcohol, to individuals the covered online
5
service knows are minors.
6
(2) A covered online service is prohibited from using dark patterns
7
or any other similar practices to subvert or impair user autonomy,
8
decision-making, or choice. Such dark patterns shall constitute a
9
deceptive trade practice under the Uniform Deceptive Trade Practices Act
10
and, in addition to any remedies or penalties available under the Age-
11
Appropriate Online Design Code Act, shall be subject to any remedies or
12
penalties available for a violation under the Uniform Deceptive Trade
13
Practices Act.
14
Sec. 10. (1) Each covered online service that utilizes personalized
15
recommendation systems is required to describe in its terms and
16
conditions, in a clear, conspicuous and easy to understand manner, how
17
such systems are used to provide information to minors and information
18
regarding how minors or their parents can opt out of or control such
19
systems.
20
(2) A covered online service shall provide clear, conspicuous, easy
21
to understand, and comprehensive information in a prominent location
22
describing the design safety for minors, the privacy protections for
23
minors, and the tools for parents that the covered online service has
24
adopted. Such disclosure shall also include a clear, conspicuous, and
25
easy to understand explanation as to how minors and parents may utilize
26
such design safety measures, privacy protections, and tools.
27
Sec. 11. (1) A covered online service shall annually issue a public
28
report, prominently posted to its website, prepared by an independent
29
third-party auditor that contains the following information:
30
(a) A detailed description of the covered online service as it
31
LB504
2025
LB504
2025
-11-
pertains to minors, including its covered design features, its use of
1
personal data, and its business practices. Each report shall include the
2
following information, categorized by age group if appropriate:
3
(i) The purpose of the covered online service;
4
(ii) The extent to which the covered online service is likely to be
5
accessed by minors;
6
(iii) An accounting of the number of users the covered online
7
service knows to be minors in the state and an accounting of how much
8
time such users, separated by age group, spend on the covered online
9
service;
10
(iv) An accounting of the total number and types of reports made
11
pursuant to section 8 of this act and an assessment of how such harms
12
were addressed;
13
(v) Whether, how, and for what purpose the covered online service
14
collects or processes the personal data of minors;
15
(vi) Whether, how, and for what purpose the covered online service
16
collects or processes the sensitive personal data of minors;
17
(vii) The design safety features for minors, the privacy protections
18
for minors, and the tools for parents that the covered online service has
19
adopted;
20
(viii) Whether and how the covered online service uses covered
21
design features;
22
(ix) The covered online service's process for handling data access,
23
deletion, and correction requests for the data of a minor;
24
(x) Age verification or estimation methods used by the covered
25
online service; and
26
(xi) Whether and how the covered online service utilizes algorithms.
27
(2) An independent third-party auditor that prepares a report
28
required
pursuant
to
this
section
shall
follow
inspection
and
29
consultation
practices
designed
to
ensure
that
such
report
is
30
comprehensive and accurate. Any such report shall be prepared in
31
LB504
2025
LB504
2025
-12-
consultation with experts on minors' use of covered online services.
1
(3) A covered online service shall provide an independent third-
2
party auditor that prepares a report required under this section full and
3
complete cooperation and access to information and operations required to
4
ensure that the report is comprehensive and accurate.
5
Sec. 12. (1) The Attorney General shall enforce the Age-Appropriate
6
Online Design Code Act and may investigate compliance with the act. The
7
Attorney General may adopt and promulgate rules and regulations to carry
8
out the act.
9
(2) Each covered online service shall designate one or more officers
10
of the company as responsible for the covered online service's compliance
11
with the Age-Appropriate Online Design Code Act.
12
(3) A covered online service in violation of the Age-Appropriate
13
Online Design Code Act may be liable for a civil penalty not to exceed
14
fifty thousand dollars for each violation.
15
Sec. 13. This act becomes operative on January 1, 2026.
16
Sec. 14. If any section in this act or any part of any section is
17
declared invalid or unconstitutional, the declaration shall not affect
18
the validity or constitutionality of the remaining portions.
19
LB504
2025
LB504
2025
-13-
As enrolled or final
17,066 characters
LEGISLATIVE BILL 504
Approved by the Governor May 30, 2025
Introduced by Bosn, 25; at the request of the Governor; Ballard, 21; Bostar,
29; Prokop, 27.
A BILL FOR AN ACT relating to consumer protections; to adopt the Age-
Appropriate Online Design Code Act; to provide an operative date; and to
provide severability.
Be it enacted by the people of the State of Nebraska,
Section 1. Sections 1 to 9 of this act shall be known and may be cited as
the Age-Appropriate Online Design Code Act.
Sec. 2. For purposes of the Age-Appropriate Online Design Code Act:
(1) Actual knowledge includes all information and inferences known to the
covered online service relating to the age of the individual, including, but
not limited to, self-identified age, and any age the covered online service has
attributed or associated with the individual for any purpose, including
marketing, advertising, or product development. If a covered online service's
classification of an individual for purposes of marketing or advertising is
inconsistent with the individual's self-identified age, a covered online
service shall disregard self-identified age for purposes of the act;
(2) Child means an individual younger than thirteen years of age;
(3) Covered design feature means any feature or component of a covered
online service that will encourage or increase the frequency, time spent, or
activity of a user on the covered online service and includes:
(a) Infinite scroll;
(b) Rewards or incentives for frequency of visits or time spent on the
covered online service;
(c) Notifications or push alerts;
(d) In-game purchases; or
(e) Appearance-altering filters;
(4) Covered minor means a user that a covered online service knows to be a
minor;
(5)(a) Covered online service means a sole proprietorship, a limited
liability company, a corporation, an association, or any other legal entity
that owns, operates, controls, or provides an online service that:
(i) Conducts business in this state;
(ii) Alone, or jointly with its affiliates, subsidiaries, or parent
companies, determines the purposes and means of the processing of consumers'
personal data;
(iii) Has annual gross revenue in excess of twenty-five million dollars,
adjusted every odd-numbered year to reflect changes in the Consumer Price Index
for All Urban Consumers published by the Federal Bureau of Labor Statistics for
the two-year period preceding the adjustment date. The amount shall be rounded
to the next highest one-thousand-dollar amount;
(iv) Annually buys, receives, sells, or shares the personal data of fifty
thousand or more consumers, households, or devices, alone or in combination
with its affiliates, subsidiaries, or parent companies; and
(v) Derives at least fifty percent of its annual revenue from the sale or
sharing of consumers' personal data.
(b) A covered online service includes:
(i) An entity that controls or is controlled by a business that meets the
definition of covered online service if the entity and business share a name,
service mark, or trademark that would cause a reasonable consumer to understand
that the entity and business are commonly owned; and
(ii) For a covered online service that is a joint venture or partnership,
any person with an ownership interest of forty percent or more in such venture
or partnership.
(c) A covered online service does not include an online service with
actual knowledge that fewer than two percent of its users are minors, provided
that, in making such assessment, an online service shall not be required to
collect personal data of users, and if an online service collects personal data
of users for such purpose, it shall not use such personal data for other
purposes and shall delete such personal data after using it to make the
assessment;
(6) Dark pattern means a user interface designed or manipulated with the
effect of substantially subverting or impairing user autonomy, decision-making,
or choice. Dark pattern includes any practice determined to be a dark pattern
by the Federal Trade Commission as of January 1, 2024;
(7) Knows to be a child or knows to be a minor means actual knowledge that
the user is a child or minor, as applicable;
(8) Minor means an individual younger than eighteen years of age;
(9) Online service means any service, product, or feature that is
accessible to the public via the Internet, including a website or application.
An online service does not include any of the following:
(a) A telecommunications service as defined in 47 U.S.C. 153;
(b) A broadband Internet access service as defined in 47 C.F.R. 8.1(b); or
LB504
2025
LB504
2025
-1-
(c) The sale, delivery, or use of a physical device;
(10) Parent has the same meaning as in the federal Children's Online
Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., and the Federal Trade
Commission rules implementing such act;
(11) Personal data means any information, including derived data and
unique identifiers, that is linked or reasonably linkable, alone or in
combination with other information, to an identified or identifiable individual
or to a device that identifies, is linked to, or is reasonably linkable to one
or more identified or identifiable individuals in a household. Personal data
does not include publicly available data;
(12) Personalized recommendation system means a fully or partially
automated system used to suggest, promote, or rank content, including other
users, hashtags, or posts, based on the personal data of users;
(13) Precise geolocation information means any data that identifies within
a radius of one thousand seven hundred fifty feet a covered minor's present or
past location or the present or past location of a device that links or is
linkable to a covered minor or any data that is derived from a device that is
used or intended to be used to locate a covered minor within a radius of one
thousand seven hundred fifty feet by means of technology that includes a global
positioning system that provides latitude and longitude coordinates. Precise
geolocation information does not include the content of communications or any
data generated or connected to advanced utility metering infrastructure systems
or equipment for use by a utility;
(14) Process means to perform an operation or set of operations by manual
or automated means on personal data. Process includes collecting, using,
storing, disclosing, sharing, analyzing, deleting, or modifying personal data;
(15) Profile means any form of automated processing of personal data to
evaluate, analyze, or predict certain aspects relating to a covered minor,
including a covered minor's economic situation, health, personal preferences,
interests, reliability, behavior, location, or movements;
(16) Publicly available data means data (a) that is lawfully made
available from federal, state, or local government records, (b) that a business
has a reasonable basis to believe is lawfully made available to the general
public by the individual or from widely distributed media, or (c) that is made
available by a person to whom the individual has disclosed the data if the
individual has not restricted the data to a specific audience. Publicly
available data does not mean biometric data collected by a covered online
service about a covered minor without the covered minor's knowledge;
(17) Targeted advertising means displaying advertisements to an individual
when the advertisement is selected based on personal data obtained or inferred
from that individual's activities over time and across nonaffiliated websites
or online applications to predict the individual's preferences or interest.
Targeted advertising does not include:
(a) Advertisements based on activities within a covered online service's
own Internet websites or online applications;
(b) Advertisements based on the context of an individual's current search
query, visit to an Internet website, or use of an online application;
(c) Advertisements directed to an individual in response to the
individual's request for information or feedback; or
(d) Processing personal data solely to measure or report advertising
frequency, performance, or reach; and
(18) User means, with respect to a covered online service, an individual
who registers an account or creates a profile on the covered online service.
Sec. 3. (1) The Age-Appropriate Online Design Code Act does not apply to:
(a) A federal, state, tribal, or local government entity in the ordinary
course of its operations;
(b) Personal data subject to a statute or regulation that is controlled by
a covered online service that is required to comply with:
(i) Title V of the federal Gramm-Leach-Bliley Act;
(ii) The federal Health Information Technology for Economic and Clinical
Health Act; or
(iii) Regulations promulgated under section 264 of the federal Health
Insurance Portability and Accountability Act of 1996; and
(c) Information, including, but not limited to, personal data, collected
as part of a clinical trial subject to the federal policy for the protection of
human subjects in accordance with:
(i) Good clinical practice guidelines issued by the International Council
for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;
or
(ii) Human subject protection requirements of the federal Food and Drug
Administration.
(2) The requirements of the Age-Appropriate Online Design Code Act are in
addition to and shall not limit or restrict in any way the application of other
laws, including, but not limited to, statutes, rules and regulations, and the
common law of Nebraska.
(3) In the event of a conflict between the Age-Appropriate Online Design
Code Act and one or more other laws, the law that affords the greatest
protection from harm to minors shall control.
Sec. 4. (1) A covered online service shall provide each covered minor
with accessible and easy-to-use tools that accomplish the following with
respect to covered design features:
(a) Limit the ability of other users or visitors to communicate with the
covered minor;
LB504
2025
LB504
2025
-2-
(b) Prevent other individuals from viewing the personal data of the
covered minor;
(c) Control the operation of all design features, including, but not
limited to, all covered design features, that are unnecessary in order to
provide the covered online service by allowing a covered minor to opt out of
the use of all unnecessary covered design features or categories of unnecessary
covered design features;
(d) Control personalized recommendation systems by allowing a covered
minor to opt in to a chronological feed or by preventing categories of content
from being recommended;
(e) Control the use of in-game purchases or other transactions by allowing
a covered minor to opt out of all such purchases and transactions or to place
limits on such purchases and transactions; and
(f) Restrict the sharing of the precise geolocation information of the
covered minor and provide notice regarding tracking of the covered minor's
precise geolocation information.
(2) A covered online service shall provide a covered minor with accessible
and easy-to-use options to limit the amount of time the covered minor spends on
the covered online service.
(3) A covered online service shall establish default settings for the
safeguards required by subsection (1) of this section at the option or level
that provides the highest protection available for the safety of the covered
minor.
Sec. 5. (1) A covered online service shall only collect and use the
minimum amount of a covered minor's personal data necessary to provide the
specific elements of an online service with which the covered minor has
knowingly engaged. Such personal data shall not be used for reasons other than
those for which it was collected.
(2) A covered online service shall not be required to collect the personal
data of a user to comply with the Age-Appropriate Online Design Code Act. A
covered online service that collects personal data of a user for age
verification cannot use such personal data for other purposes and shall delete
such personal data after use for age verification.
(3) A covered online service shall only retain the personal data of a
covered minor as long as necessary to provide the specific elements of an
online service with which the covered minor has knowingly engaged.
(4) A covered online service shall not facilitate targeted advertising to
a covered minor.
(5) A covered online service shall provide an obvious sign to a covered
minor when precise geolocation information is being collected or used.
(6) The use of notifications and push alerts to a covered minor is
prohibited between the hours of 10 p.m. and 6 a.m. and between the hours of 8
a.m. and 4 p.m. on week days during the school year in the covered minor's
local time zone.
(7) A covered online service shall not profile a covered minor unless
profiling is necessary to provide a covered online service requested by such
covered minor, and only with respect to the aspects of the covered online
service with which the covered minor is actively and knowingly engaged.
(8) A covered online service shall ensure that the default settings for
the protections required pursuant to this section are set at the highest
protection available for the safety of the covered minor.
(9) If a covered online service allows parental monitoring, the covered
online service shall provide an obvious signal to a covered minor when such
minor is being monitored.
Sec. 6. (1) A covered online service shall provide parents with tools to
help parents protect and support minors using covered design features of the
covered online service. Such parental tools shall be enabled by default for an
individual the covered online service knows to be a child.
(2) With respect to covered design features, a covered online service
shall provide parents the ability to do the following for an individual the
covered online service knows to be a child or minor, as applicable:
(a) Manage the child's privacy and account settings in a manner that
allows parents to:
(i) View the child's account settings; and
(ii) Change and control privacy and account settings of the child;
(b) Restrict purchases and financial transactions of the minor; and
(c) Enable parents to view the total time the child has spent on a covered
online service and place reasonable limits on such child's use of the covered
online service. Among such protections, a covered online service shall offer
parents the ability to restrict a child's use of the covered online service
during times of day specified by the parents, including during school hours and
at night.
(3) A covered online service shall notify a covered minor of a covered
design feature when any of the tools described in this section are in effect
and describe what settings have been applied.
Sec. 7. A covered online service shall establish mechanisms for covered
minors and parents to report harms on covered online services.
Sec. 8. (1) A covered online service is prohibited from facilitating
advertisements for prohibited products, such as narcotic drugs, tobacco
products, gambling, and alcohol, to covered minors.
(2) A covered online service is prohibited from using dark patterns to
subvert or impair covered minor autonomy, decision-making, or choice.
Sec. 9. (1) Any violation of the Age-Appropriate Online Design Code Act
LB504
2025
LB504
2025
-3-
shall, additionally and separately, constitute a deceptive trade practice under
the Uniform Deceptive Trade Practices Act. Civil penalties for violations of
the Age-Appropriate Online Design Code Act shall be subject exclusively to
subsection (3) of this section, but the Attorney General shall not initiate any
action to recover a civil penalty under the act until July 1, 2026. The Age-
Appropriate Online Design Code Act shall not be construed to affect the
liability for any action that otherwise violates the Uniform Deceptive Trade
Practices Act.
(2) Each covered online service shall designate one or more of its
officers to be responsible for the covered online service's compliance with the
Age-Appropriate Online Design Code Act.
(3) Beginning July 1, 2026, a covered online service in violation of the
Age-Appropriate Online Design Code Act may be liable for a civil penalty not to
exceed fifty thousand dollars for each violation. All penalties collected under
this section shall be remitted to the State Treasurer for distribution in
accordance with Article VII, section 5, of the Constitution of Nebraska.
Sec. 10. This act becomes operative on January 1, 2026.
Sec. 11. If any section in this act or any part of any section is
declared invalid or unconstitutional, the declaration shall not affect the
validity or constitutionality of the remaining portions.
LB504
2025
LB504
2025
-4-