Nebraska Joins the Kids Code Movement

The regulatory landmines in children’s data protection are multiplying, and in 2026, Nebraska officially steps into the field.

With the passage of LB 504, the Cornhusker State enacted its own comprehensive Age Appropriate Online Design Code, joining states like California and Maryland but, in some respects, going further. The Nebraska Kids Code (the “Code”) took effect on January 1, 2026, with enforcement beginning July 1, 2026.

For companies offering online services that reach minors in Nebraska, this is not a wait-and-see statute. It demands immediate attention.

Who’s in Scope?

 The Code applies to “covered online services,” meaning businesses that operate in Nebraska and process personal information, and that meet all three of the following thresholds:

• Annual gross revenue exceeding $25 million.
• Annually buy, receive, sell, or share personal data of 50,000 or more consumers, households, or devices.
• Derive at least 50 percent of annual revenue from the sale or sharing of consumers’ personal information.

These criteria must all be met.

Privacy Rules That Raise the Stakes

Much of the Code reflects principles already familiar to us: data minimization, retention limits, and restrictions on targeted advertising to teens. But Nebraska sharpens the focus on minors. 

Among the more notable provisions:

• Personal data cannot be collected solely to comply with the Code.
• Data collected for age verification cannot be repurposed and must be deleted after verification.
• Profiling minors is prohibited unless strictly necessary to provide the service.

“Profiling” includes automated processing used to evaluate or predict aspects such as health, economic status, interests, behavior, location, or movements.

The Code also restricts sharing precise geolocation data and requires clear notice when tracking occurs. Targeted advertising to teens is flatly restricted.

Design Is Now a Compliance Issue

A notable requirement of the Code is that it mandates online services to develop tools enabling minors to control the operation of all design features – particularly “covered design features” that are not necessary to provide the service – and allow the minor to opt out of these features. The “covered design features” are as follows:

• Infinite scroll.
• Rewards or incentives tied to time spent or frequency of visits.
• Notifications or push alerts.
• In-game purchases (e.g., loot boxes, cosmetic items, virtual currency).
• Appearance-altering filters (e.g., avatar customization tools and photo mode filters).

We note that this will directly impact core video game monetization strategies, including engagement mechanics, microtransactions, and notification loops designed to drive player retention.

Mandatory User Controls

In addition, the Code requires online services to have accessible and easy-to-use tools that accomplish the following with respect to these “covered design features” :

• Limit who can communicate with them.
• Prevent others from viewing their personal data.
• Switch personalized recommendation systems to a chronological feed or block certain categories of content (directly affecting microtransactions and virtual currency systems).
• Limit or opt out of in-game purchases and transactions.

 There are also requirements that online services develop tools for parents, also in particular related to the covered design features, including the following:

• Adjust privacy and account settings.
• Restrict purchases.
• View total time spent and set usage limits.

Finally, the Nebraska Kids Code also gives some control back to the minor as it also includes a provision requiring the online service to notify the minor when the tools are in effect and describe the settings that have been applied to the covered design feature.  

Additional Guardrails

The Code also imposes additional requirements that provide minors with greater control over their experience with online services. Notable provisions include:

• Provide an easy option for minors to limit their time on the platform.
• Disable push notifications between 10 p.m. and 6 a.m., and between 8 a.m. and 4 p.m (which may affect time-limited in-game events and promotional notifications).
• Ban advertising of prohibited products, including narcotics, tobacco, gambling, and alcohol.
• Avoid dark patterns that undermine minors’ autonomy.
• Establish reporting mechanisms for minors and parents.

Finally, the Code requires online services to enable many of the above tools and design settings by default.

Compliance Officer 

One notable point for those online services that do business in Nebraska and are covered by the Code, there is a requirement that each covered online service must designate one or more officers responsible for compliance.  

Enforcement 

Enforcement authority rests with the Nebraska Attorney General and commences on July 1, 2026. Violations constitute a deceptive trade practice under the Uniform Deceptive Trade Practices Act, with civil penalties reaching up to $50,000 per violation. Given the iterative nature of video game updates and feature deployments, companies should implement robust compliance review processes to mitigate enforcement risk.