Nebraska Children's Privacy Laws (2026)

Parental Rights in Social Media Act (LB 383) · LB 383

Enacted, enjoined: Passed, but a court has currently blocked enforcement. · Social media · effective 2026-07-01 · binds operators

Ages: Minors under 18

Requires: Social media platforms must verify every user's age via commercially reasonable methods (third-party vendor / digitized ID, with no data retention) and obtain verifiable parental/guardian consent before a minor under 18 may create or hold an account; must give parents tools to view the minor's posts/messages and control privacy, account settings, and time spent.

Litigation: NetChoice v. Hilgers, 4:26-cv-03149 (D. Neb.). On 2026-06-27, Judge Gerrard granted in part / denied in part the PI motion (docket entry 33): Sec 28(1)(a) (age verification) and Sec 28(2) (parental consent) are preliminarily ENJOINED as likely unconstitutional; Sec 28(4)(a)-(b) (parental monitoring/dashboard) survive and remain enforceable and took effect 2026-07-01. On 2026-07-08 the Attorney General moved to stay all district-court deadlines pending an interlocutory appeal to the Eighth Circuit (docket entry 36, unopposed); the magistrate judge granted the stay on 2026-07-09 (docket entry 38), with the parties to contact chambers within 14 days of the Eighth Circuit's mandate. The injunction remains in force and no appellate ruling has issued.

Entry last reviewed 2026-07-18

Nebraska Age-Appropriate Online Design Code Act (LB 504), as amended by LB 838 · LB 504 (2025), as amended by LB 838 (2026)

In force: Effective and enforceable today. · Design code · in force since 2026-01-01, with Attorney General enforcement open since 2026-07-01; the LB 838 (2026) amendments in Secs. 31 to 38, signed 2026-04-14, became operative 2026-07-18 per the Revisor's operative-date note on the codified sections · binds operators, developers

Ages: Covered minors under 18 the service knows to be a minor; 'child' = under 13 (heightened protections)

Requires: Covered online services must apply privacy-and-safety-by-default at the highest protection for known minors: data minimization (collect/retain only what is needed for the feature the minor knowingly uses), no targeted advertising to a covered minor, no profiling unless necessary for a service the minor actively requested, limits/notice on precise geolocation, and a ban on dark patterns and on advertising prohibited products (drugs, tobacco, gambling, alcohol) to covered minors. It also requires opt-out controls over 'covered design features', a chronological-feed option and time-management tools, and parental tools enabled by default for known children. LB 838 (2026) widened it in ways that matter to a kids' product: the old 'derives at least 50 percent of annual revenue from selling or sharing personal data' threshold is gone, replaced by a majority-of-revenue-from-online-services test plus either $25M in revenue or 50,000 consumers, households or devices, so ordinary subscription and ad-supported apps are now in scope. 'Covered design feature' grew from 5 items to 11, adding visible engagement counts, gamification such as streaks and badges, notification clustering, virtual currency, image filters, forced account creation, ephemerality, deletion barriers, and a feature that increases usage through the illusion of talking with a human being in a way that seeks to elicit feelings of intimacy. New Secs. 33 and 34 bar any single control that makes all defaults less protective, bar prompting a minor to weaken settings, and require account unpublish or delete requests to be honored within 15 days. Notifications and push alerts to covered minors are barred from 10 p.m. to 6 a.m. and from 8 a.m. to 4 p.m. on week days during the school year, in the minor's local time zone. LB 838 also added a Gramm-Leach-Bliley carve-out and removed the earlier duty to delete data collected during age assessment.

Litigation: Not currently enjoined. NetChoice publicly urged a veto and has raised First Amendment objections, but has not sued over LB 504. NetChoice v. Hilgers (D. Neb., filed May 2026) challenges a separate Nebraska statute, the Parental Rights in Social Media Act (LB 383, age-verification/parental-consent), not the Design Code Act.

Entry last reviewed 2026-08-07

Nebraska Data Privacy Act: minors' provisions · LB1074

In force: Effective and enforceable today. · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known children under 13 (no heightened 13-17 teen band)

Requires: Personal data collected from a known child (under 13) is classified as 'sensitive data.' A controller must not process such known-child sensitive data except in accordance with the federal Children's Online Privacy Protection Act (COPPA); complying with COPPA's parental-consent requirements satisfies the Act. The Act adds no separate heightened opt-in or targeted-advertising/profiling regime for teens aged 13-17; those consumers have only the same opt-out rights as adults.

Entry last reviewed 2026-07-18

Conversational Artificial Intelligence Safety Act (LB 525, Secs. 12 to 18) · LB 525 (2026), Secs. 12 to 18; Sec. 19 sets the operative date

Enacted, not yet effective: Signed into law; its effective date is still in the future. · AI companion · Sec. 19 makes the Act's sections operative on a specified date, 2027-07-01, rather than Nebraska's default three months after sine die · binds operators

Ages: Operator has actual knowledge or reasonable certainty the individual is under 18; parent or guardian tools for account holders under 13

Requires: For minor account holders, operators of public conversational AI services must disclose AI status through a persistent visible disclaimer or, alternatively, at each session start plus at least every three hours of continuous interaction, must block sexually explicit and human-impersonation outputs, may not use unpredictable engagement rewards, and must offer privacy tools, with parent or guardian tools for children under 13. For all users, operators need a suicide and self-harm referral protocol, may not claim to provide professional mental health care, and must disclose AI status wherever a reasonable person would otherwise be misled into thinking they are talking to a human. Attorney General enforcement, including suits on behalf of aggrieved persons, with civil penalties of at least $1,000 per violation capped at $500,000 per operator; no private right of action, and AI model developers are shielded from liability for a third-party operator's violations. Enacted inside an omnibus whose title also adopts the Agricultural Data Privacy Act, so the bill caption reads agricultural.

Litigation: None. Not challenged; no AI companion-chatbot law in any state has been sued over.

Entry last reviewed 2026-07-24