Another jurisdiction implements children’s online privacy code, this time Nebraska’s Age Appropriate Design Code
July 8, 2025 |
The protection of children’s privacy on line is a key area of regulation and development worldwide. The US State of Nebraska has from 30 May 2025 implemented an age-appropriate design code law. The Code mandates online service providers prioritize children’s privacy and safety through proactive design principles. Effective January 1, 2026, the Code imposes stringent requirements on covered entities, including data minimisation, default privacy settings, and restrictions on targeted advertising to minors. Enforcement by the Nebraska Attorney General begins on July 1, 2026, with penalties up to $50,000 per violation.
The Code requries collection and use of the minimal personal data necessary to deliver the specific services a minor knowingly engages with. Data use beyond this purpose is prohibited unless explicitly consented to by the minor or their parent.
There is an obligation for online services to have default settings which offer the highest level of privacy protection for minors including:
- limiting communication between minors and other users;
- preventing unauthorised access to minors’ personal data;
- restricting precise geolocation tracking;
- allowing the minor to control all design features unnecessary to operate the services requested by the minor;
- permitting the minor to control personalised recommendation systems by allowing opt-in to chronological feeds or prevent certain types of content from being recommended; and
- controlling the use of in-game purchases by allowing opt-outs or the option to limit such purchases.
These settings apply to ‘covered design features.’.
Under the Code there is a prohibition on:
- targeted advertising to minors based on their online behavior;
- advertising of prohibited products; and
- profiling minors, unless it is necessary to provide a requested service
- dark patterns, user interface designs that impair autonomy or manipulate choices.
The Code requires push notifications to be disabled during school hours and nighttime on weekdays.
Under the Code there is parental involvement, particularly for children under the age of 13 years. The Services must provide parents with tools to:
- manage privacy and account settings;
- restrict in-app purchases;
- monitor and limit time spent on the platform; and
- control data sharing preferences.
These tools align with federal requirements under the Children’s Online Privacy Protection Act.
Given the Privacy Commissioner is undertaking a 2 year, now 18 months, process of developing a Children’s Code it is relevant to have regard to this and other codes. This code is the third state to enact a Children’s on line privacy code, following California (2022) and Maryland (2024). Vermont has also enacted a similar statute which will come into effect on January 1, 2027