Sections 87-1301 to 87-1311 shall be known and may be cited as the Age-Appropriate Online Design Code Act.

For purposes of the Age-Appropriate Online Design Code Act:

(1) Actual knowledge includes all information and inferences known to the covered online service relating to the age of the individual, including, but not limited to, self-identified age, and any age the covered online service has attributed or associated with the individual for any purpose, including marketing, advertising, or product development. If a covered online service's classification of an individual for purposes of marketing or advertising is inconsistent with the individual's self-identified age, a covered online service shall disregard self-identified age for purposes of the act;

(2) Child means an individual younger than thirteen years of age;

(3) Covered design feature means any feature or component of a covered online service that will encourage or increase the frequency, time spent, or activity of a user on the covered online service and includes:

(a) Infinite scroll or a design feature where content automatically and continuously loads at the bottom of a screen, other than what the user explicitly prompted, requested, or searched for;

(b) Auto-playing video or audio, or a design feature in which a video or audio automatically begins playing when a user navigates to or scrolls through a set of videos without any explicit action on the part of a user indicating the user's desire to watch that specific video or listen to that audio;

(c) Quantification of engagement, including, but not limited to, providing a visible count of how many likes, comments, clicks, views, or reactions a user-generated item has received;

(d) Gamification, or a design feature that emulates gameplay, including, but not limited to, a streak, badge, or reward that motivates or causes more frequent or more extensive use of an online service through incentives or frequency of use;

(e) The use of clustering, timing, or volume of notifications or push alerts, irrespective of content;

(f) A design feature in which virtual currencies are used or where digital items are purchased;

(g) Image-altering filters or a design feature that facilitates a false perception of an image;

(h) Requiring or repeatedly prompting for account creation in order to access publicly available user-generated content;

(i) Using ephemerality to prompt the urgent use of an online service;

(j) Creating barriers to deleting an account or to removing connections to other users of the service; or

(k) A feature that increases usage through the illusion of talking with a human being that seeks to elicit feelings of intimacy from the user;

(4) Covered minor means a user that a covered online service knows to be a minor;

(5)(a) Covered online service means a sole proprietorship, a limited liability company, a corporation, an association, or any other legal entity that:

(i) Conducts business in this state;

(ii) Generates a majority of its annual revenue from online services;

(iii) Alone, or jointly with its affiliates, subsidiaries, or parent companies, determines the purposes and means of the processing of consumers' personal data; and

(iv) Satisfies at least one of the following:

(A) Has annual gross revenue in excess of twenty-five million dollars, adjusted every odd-numbered year to reflect changes in the Consumer Price Index for All Urban Consumers published by the Federal Bureau of Labor Statistics for the two-year period preceding the adjustment date. The amount shall be rounded to the next highest one-thousand-dollar amount; or

(B) Annually processes the personal data of fifty thousand or more consumers, households, or devices, alone or in combination with its affiliates, subsidiaries, or parent companies.

(b) A covered online service includes:

(i) An entity that controls or is controlled by a business that meets the definition of covered online service if the entity and business share a name, service mark, or trademark that would cause a reasonable consumer to understand that the entity and business are commonly owned; and

(ii) For a covered online service that is a joint venture or partnership, any person with an ownership interest of forty percent or more in such venture or partnership.

(c) A covered online service does not include (i) an online service with actual knowledge that fewer than two percent of its users are minors, provided that, in making such assessment, an online service shall not be required to collect personal data of users, and if an online service collects personal data of users for such purpose, it shall not use such personal data for other purposes or (ii) a financial institution subject to Title V of the Gramm-Leach-Bliley Act or any regulations adopted in accordance with such act;

(6) Dark pattern means a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decisionmaking, or choice. Dark pattern includes any practice determined to be a dark pattern by the Federal Trade Commission;

(7) Knows to be a child or knows to be a minor means actual knowledge that the user is a child or minor, as applicable;

(8) Minor means an individual younger than eighteen years of age;

(9) Online service means any service, product, or feature that is accessible to the public via the Internet, including a website or application. An online service does not include any of the following:

(a) A telecommunications service as defined in 47 U.S.C. 153;

(b) A broadband Internet access service as defined in 47 C.F.R. 8.1(b); or

(c) The sale, delivery, or use of a physical device;

(10) Parent has the same meaning as in the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., and the Federal Trade Commission rules implementing such act;

(11) Personal data means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household. Personal data does not include publicly available data;

(12) Personalized recommendation system means a fully or partially automated system used to suggest, promote, or rank content, including other users, hashtags, or posts, based on the personal data of users;

(13) Precise geolocation information means any data that identifies within a radius of one thousand seven hundred fifty feet a covered minor's present or past location or the present or past location of a device that links or is linkable to a covered minor or any data that is derived from a device that is used or intended to be used to locate a covered minor within a radius of one thousand seven hundred fifty feet by means of technology that includes a global positioning system that provides latitude and longitude coordinates. Precise geolocation information does not include the content of communications or any data generated or connected to advanced utility metering infrastructure systems or equipment for use by a utility;

(14) Process means to perform an operation or set of operations by manual or automated means on personal data. Process includes collecting, using, storing, disclosing, sharing, analyzing, deleting, or modifying personal data;

(15) Profile means any form of automated processing of personal data to evaluate, analyze, or predict certain aspects relating to a covered minor, including a covered minor's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

(16) Publicly available data means data (a) that is lawfully made available from federal, state, or local government records, (b) that a business has a reasonable basis to believe is lawfully made available to the general public by the individual or from widely distributed media, or (c) that is made available by a person to whom the individual has disclosed the data if the individual has not restricted the data to a specific audience. Publicly available data does not mean biometric data collected by a covered online service about a covered minor without the covered minor's knowledge;

(17) Targeted advertising means displaying advertisements to an individual when the advertisement is selected based on personal data obtained or inferred from that individual's activities over time and across nonaffiliated websites or online applications to predict the individual's preferences or interest. Targeted advertising does not include:

(a) Advertisements based on activities within a covered online service's own Internet websites or online applications;

(b) Advertisements based on the context of an individual's current search query, visit to an Internet website, or use of an online application;

(c) Advertisements directed to an individual in response to the individual's request for information or feedback; or

(d) Processing personal data solely to measure or report advertising frequency, performance, or reach; and

(18) User means, with respect to a covered online service, an individual who registers an account or creates a profile on the covered online service.

(1) The Age-Appropriate Online Design Code Act does not apply to:

(a) A federal, state, tribal, or local government entity in the ordinary course of its operations;

(b) Personal data subject to a statute or regulation that is controlled by a covered online service that is required to comply with:

(i) Title V of the federal Gramm-Leach-Bliley Act;

(ii) The federal Health Information Technology for Economic and Clinical Health Act; or

(iii) Regulations promulgated under section 264 of the federal Health Insurance Portability and Accountability Act of 1996; and

(c) Information, including, but not limited to, personal data, collected as part of a clinical trial subject to the federal policy for the protection of human subjects in accordance with:

(i) Good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or

(ii) Human subject protection requirements of the federal Food and Drug Administration.

(2) The requirements of the Age-Appropriate Online Design Code Act are in addition to and shall not limit or restrict in any way the application of other laws, including, but not limited to, statutes, rules and regulations, and the common law of Nebraska.

(3) In the event of a conflict between the Age-Appropriate Online Design Code Act and one or more other laws, the law that affords the greatest protection from harm to minors shall control.

(1) A covered online service shall provide each covered minor with accessible and easy-to-use tools that:

(a) Limit the ability of other users or visitors to communicate with the covered minor;

(b) Prevent other individuals from viewing the personal data of the covered minor;

(c) Control the operation of all design features, including, but not limited to, all covered design features, that are unnecessary in order to provide the covered online service by allowing a covered minor to opt out of the use of all unnecessary covered design features or categories of unnecessary covered design features;

(d) Control personalized recommendation systems by allowing a covered minor to opt in to a chronological feed or by preventing categories of content from being recommended;

(e) Control the use of in-game purchases or other transactions by allowing a covered minor to opt out of all such purchases and transactions or to place limits on such purchases and transactions; and

(f) Restrict the sharing of the precise geolocation information of the covered minor and provide notice regarding tracking of the covered minor's precise geolocation information.

(2) A covered online service shall provide a covered minor with accessible and easy-to-use options to limit the amount of time the covered minor spends on the covered online service.

(3) A covered online service shall establish default settings for the safeguards required by subsection (1) of this section at the option or level that provides the highest protection available for the safety of the covered minor.

(1) A covered online service shall only collect and use the minimum amount of a covered minor's personal data necessary to provide the specific elements of an online service with which the covered minor has knowingly engaged. Such personal data shall not be used for reasons other than those for which it was collected.

(2) A covered online service shall not be required to collect the personal data of a user to comply with the Age-Appropriate Online Design Code Act. A covered online service that collects personal data of a user for age verification cannot use such personal data for other purposes.

(3) A covered online service shall only retain the personal data of a covered minor as long as necessary to provide the specific elements of an online service with which the covered minor has knowingly engaged.

(4) A covered online service shall not facilitate targeted advertising to a covered minor.

(5) A covered online service shall provide an obvious sign to a covered minor when precise geolocation information is being collected or used.

(6) The use of notifications and push alerts to a covered minor is prohibited between the hours of 10 p.m. and 6 a.m. and between the hours of 8 a.m. and 4 p.m. on week days during the school year in the covered minor's local time zone.

(7) A covered online service shall not profile a covered minor unless profiling is necessary to provide a covered online service requested by such covered minor, and only with respect to the aspects of the covered online service with which the covered minor is actively and knowingly engaged.

(8) A covered online service shall ensure that the default settings for the protections required pursuant to this section are set at the highest protection available for the safety of the covered minor.

(9) If a covered online service allows parental monitoring, the covered online service shall provide an obvious signal to a covered minor when such minor is being monitored.

(1) A covered online service shall provide parents with tools to help parents protect and support minors using covered design features of the covered online service. Such parental tools shall be enabled by default for an individual the covered online service knows to be a child.

(2) A covered online service shall provide parents the ability to do the following for an individual the covered online service knows to be a child or minor, as applicable:

(a) Manage the child's privacy and account settings in a manner that allows parents to:

(i) View the child's account settings; and

(ii) Change and control privacy and account settings of the child;

(b) Restrict purchases and financial transactions of the minor; and

(c) Enable parents to view the total time the child has spent on a covered online service and place reasonable limits on such child's use of the covered online service. Among such protections, a covered online service shall offer parents the ability to restrict a child's use of the covered online service during times of day specified by the parents, including during school hours and at night.

(3) A covered online service shall notify a covered minor when any of the tools described in this section are in effect and describe what settings have been applied.

A covered online service shall establish mechanisms for covered minors and parents to report harms on covered online services.

(1) A covered online service is prohibited from facilitating advertisements for prohibited products, such as narcotic drugs, tobacco products, gambling, and alcohol, to covered minors.

(2) A covered online service is prohibited from using dark patterns.

(1) Any violation of the Age-Appropriate Online Design Code Act shall, additionally and separately, constitute a deceptive trade practice under the Uniform Deceptive Trade Practices Act. Civil penalties for violations of the Age-Appropriate Online Design Code Act shall be subject exclusively to subsection (3) of this section, but the Attorney General shall not initiate any action to recover a civil penalty under the act until July 1, 2026. The Age-Appropriate Online Design Code Act shall not be construed to affect the liability for any action that otherwise violates the Uniform Deceptive Trade Practices Act.

(2) Each covered online service shall designate one or more of its officers to be responsible for the covered online service's compliance with the Age-Appropriate Online Design Code Act.

(3) Beginning July 1, 2026, a covered online service in violation of the Age-Appropriate Online Design Code Act may be liable for a civil penalty not to exceed fifty thousand dollars for each violation. All penalties collected under this section shall be remitted to the State Treasurer for distribution in accordance with Article VII, section 5, of the Constitution of Nebraska.

A covered online service shall not:

(1) Provide a covered minor with a single setting that makes all of the default privacy settings less protective at once; or

(2) Request or prompt a covered minor to make the covered minor's privacy settings less protective, unless the change is strictly necessary for the covered minor to access a service or feature that such covered minor has expressly and unambiguously requested.

A covered online service shall:

(1) Provide a prominent, accessible, and responsive tool to allow a covered minor to request that the covered minor's account be unpublished or deleted; and

(2) Honor a request under subdivision (1) of this section no later than fifteen days after the covered online service receives the request.