Nebraska Children’s Privacy Laws (2026)

LB 383

Enacted, enjoined · Social media · effective 2026-07-01 · binds operators

Ages: Minors under 18

Requires: A social media company may not let a minor (a Nebraska resident under 18, not emancipated, whom the platform knows or reasonably believes to be under 18) become an account holder unless a parent gives express parental consent, which the company or its vendor must verify through age verification of the parent plus a signed oath, affirmation or form. The platform must verify the age of anyone seeking to open an account on or after 2026-07-01, by digitized ID or another commercially reasonable method (a third-party vendor may do it, and no identifying information may be kept afterward); viewers without an account need no age check. Parents must be able to revoke consent, which removes the minor's account, and must get tools to view the minor's posts and the messages and responses sent to or by the minor, control the minor's privacy and account settings, and monitor and limit time spent; the Attorney General may impose up to $2,500 per violation, and a person aggrieved by a violation may sue for relief including actual damages.

Litigation: NetChoice v. Hilgers, 4:26-cv-03149 (D. Neb.). On 2026-06-27, Judge Gerrard granted in part / denied in part the PI motion (docket entry 33): Sec 28(1)(a) (age verification) and Sec 28(2) (parental consent) are preliminarily ENJOINED as likely unconstitutional; Sec 28(4)(a)-(b) (parental monitoring/dashboard) survive and remain enforceable and took effect 2026-07-01. On 2026-07-08 the Attorney General moved to stay all district-court deadlines pending an interlocutory appeal to the Eighth Circuit (docket entry 36, unopposed); the magistrate judge granted the stay on 2026-07-09 (docket entry 38), with the parties to contact chambers within 14 days of the Eighth Circuit's mandate. Both sides then filed notices of interlocutory appeal from the 2026-06-27 order (docket entry 33): the Attorney General on 2026-07-23 (docket entry 39), docketed in the Eighth Circuit as No. 26-2478, and NetChoice on 2026-07-24 (docket entry 44), docketed as No. 26-2486. On 2026-09-04 the clerk sent the designated record and the preliminary-injunction hearing transcript (docket entry 35) to the Eighth Circuit in No. 26-2486 (docket entry 48). On the district-court record the preliminary injunction remains in effect: the 2026-07-09 order stays case deadlines only, and no later district-court entry stays or alters the injunction. The Eighth Circuit's public case search shows no opinion in either appeal; whether any appellate stay order has issued is not visible from public sources.

Entry last reviewed 2026-10-01

LB 504 (2025), as amended by LB 838 (2026)

In force · Design code · effective 2026-01-01 · binds operators, developers

Ages: Covered minors under 18 the service knows to be a minor; 'child' = under 13 (heightened protections)

AI chatbot access for minors: Off by default for minors (in force).

Requires: Covered online services must apply privacy-and-safety-by-default at the highest protection for known minors: data minimization (collect/retain only what is needed for the feature the minor knowingly uses), no targeted advertising to a covered minor, no profiling unless necessary for a service the minor actively requested, limits/notice on precise geolocation, and a ban on dark patterns and on advertising prohibited products (drugs, tobacco, gambling, alcohol) to covered minors. It also requires tools to opt out of unnecessary 'covered design features', set by default to the most protective option, so for known minors those features start switched off and the minor can turn them back on, a chronological-feed option and time-management tools, and parental tools enabled by default for known children. LB 838 (2026) widened it in ways that matter to a kids' product: the old 'derives at least 50 percent of annual revenue from selling or sharing personal data' threshold is gone, replaced by a majority-of-revenue-from-online-services test plus either $25M in revenue or 50,000 consumers, households or devices, so ordinary subscription and ad-supported apps are now in scope. 'Covered design feature' grew from 5 items to 11, adding visible engagement counts, gamification such as streaks and badges, notification clustering, virtual currency, image filters, forced account creation, ephemerality, deletion barriers, and a feature that increases usage through the illusion of talking with a human being in a way that seeks to elicit feelings of intimacy. New Secs. 33 and 34 bar any single control that makes all defaults less protective, bar prompting a minor to weaken settings, and require account unpublish or delete requests to be honored within 15 days. Notifications and push alerts to covered minors are barred from 10 p.m. to 6 a.m. and from 8 a.m. to 4 p.m. on week days during the school year, in the minor's local time zone. LB 838 also added a Gramm-Leach-Bliley carve-out and removed the earlier duty to delete data collected during age assessment.

Timing: in force since 2026-01-01, with Attorney General civil-penalty actions allowed since 2026-07-01; the LB 838 (2026) amendments in Secs. 31 to 38, signed 2026-04-14, became operative 2026-07-18 per the Revisor's operative-date note on the codified sections

Litigation: Not enjoined. NetChoice publicly urged a veto and has raised First Amendment objections, but has not sued over LB 504. NetChoice v. Hilgers (D. Neb., filed May 2026) challenges a separate Nebraska statute, the Parental Rights in Social Media Act (LB 383, age-verification/parental-consent), not the Design Code Act.

Entry last reviewed 2026-10-01

LB1074

In force · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known children under 13 (no heightened 13-17 teen band)

Requires: Personal data collected from a known child (under 13) is classified as 'sensitive data.' A controller must not process such known-child sensitive data except in accordance with the federal Children's Online Privacy Protection Act (COPPA); complying with COPPA's parental-consent requirements satisfies the Act. The Act adds no separate heightened opt-in or targeted-advertising/profiling regime for teens aged 13-17; those consumers have only the same opt-out rights as adults.

Entry last reviewed 2026-10-01

LB 525 (2026), Secs. 12 to 18; Sec. 19 sets the operative date

Enacted, not yet effective · AI companion · effective 2027-07-01 · binds operators

Ages: Operator has actual knowledge or reasonable certainty the individual is under 18; parent or guardian settings tools for account holders under 13, and related parent or guardian tools for ages 13 to 17 as appropriate based on relevant risks

AI chatbot access for minors: Safeguards only (enacted, applies from 2027-07-01).

Requires: For minor account holders, operators of public conversational AI services must disclose AI status through a persistent visible disclaimer or, alternatively, at each session start plus at least every three hours of continuous interaction; must take reasonable measures to prevent sexually explicit imagery, statements urging sexual conduct or sexually objectifying the minor, and statements that would lead a reasonable person to believe they are talking to a human (claims of sentience or humanity, simulated emotional dependence, romantic or sexual innuendo, adult-minor romantic role-play); may not use unpredictable engagement rewards; and must offer minors privacy and account-settings tools, offered to parents or guardians as well for account holders under 13, plus related parent or guardian tools for minors 13 and older as appropriate based on relevant risks. For all users, operators need a suicide and self-harm referral protocol, may not claim to provide professional mental health care, and must disclose AI status wherever a reasonable person would otherwise be misled into thinking they are talking to a human. Attorney General enforcement, including suits on behalf of aggrieved persons, with civil penalties of at least $1,000 per violation capped at $500,000 per operator; no private right of action, and AI model developers are shielded from liability for a third-party operator's violations. Enacted in the same bill as the Agricultural Data Privacy Act.

Timing: Sec. 19 makes the Act's sections operative on a specified date, 2027-07-01, rather than Nebraska's default three months after sine die

Litigation: None. Not challenged.

Entry last reviewed 2026-10-01