Nebraska’s Age-Appropriate Online Design Code Act (LB504) is now operative as of January 1, 2026, following its enactment in 2025. The slip law notes the bill was approved by the Governor on May 30, 2025, and includes an operative-date provision setting January 1, 2026 as the go-live date.

Nebraska Public Media also reported the law would take effect Jan. 1, describing restrictions aimed at how online services design experiences for minors.

What the law covers

LB504 applies to a defined set of “covered online services”—entities that meet specific thresholds, including (among other criteria) >$25M in annual gross revenue, processing personal data at scale, and deriving at least 50% of annual revenue from the sale or sharing of consumers’ personal data.

The duties primarily apply when a covered online service knows a user is a minor (the statute defines “minor” as under 18 and “covered minor” as a user the service knows to be a minor).

Key operational requirements that may affect subscription products

The statute is designed to influence product mechanics—not just disclosures. Among the notable provisions:

• “Covered design features” include mechanics such as infinite scroll, rewards/incentives for time spent, notifications/push alerts, in-game purchases, and appearance-altering filters.

• Covered online services must provide minors tools to opt out of unnecessary design features, control recommendation systems (including a chronological feed opt-in), and set time-spent limits.

• The law restricts push notifications to covered minors during certain windows: 10 p.m.–6 a.m., and 8 a.m.–4 p.m. on weekdays during the school year (local time zone).

• Covered online services may not facilitate targeted advertising to covered minors and must follow data-minimization-style limits for minors’ data use.

• The statute prohibits use of dark patterns to subvert or impair minors’ autonomy, decision-making, or choice.

Enforcement and penalties

LB504 states that violations constitute a deceptive trade practice under Nebraska’s Uniform Deceptive Trade Practices Act. However, the Attorney General may not initiate an action to recover a civil penalty until July 1, 2026. Beginning July 1, 2026, civil penalties can reach up to $50,000 per violation.

Why it matters

For subscription businesses with teen usage (or products that are plausibly minor-accessible), Nebraska’s law adds to the broader shift toward “safety/privacy by design” oversight—where regulators scrutinize engagement and recommendation mechanics, defaults, and prompts, not only privacy policies.

The law has also drawn national attention as part of the growing wave of state “design code” efforts focused on minors.

INSIDER TAKE

Even if a subscription business ultimately falls outside LB504’s “covered online service” thresholds, the law is still a useful read for operators because it shows exactly where state regulators are trying to move the goalposts: away from privacy-policy compliance and toward day-to-day product decisions that shape how minors experience onboarding, recommendations, prompts, and notifications. In other words, Nebraska is treating design choices—defaults, engagement mechanics, and personalization logic—as a compliance surface area.

• Even for companies that may not meet LB504’s threshold definition of a “covered online service,” the statute’s focus on recommendations, nudges, notifications, and engagement features signals where regulators are heading next.

• Enforcement posture matters: operative now, but civil-penalty actions delayed until July 1, 2026—a runway that sophisticated operators will use to align product governance and documentation before penalties are on the table.