As efforts to safeguard children's online privacy gain momentum, Nebraska and Vermont have become the latest U.S. states to introduce age-appropriate design code laws. These efforts mark a growing expansion of child-focused digital regulations and reflect increasing bipartisan concern over how online platforms handle the data and experiences of users under age 18.
The age-appropriate design codes implement guidelines for organizations aimed at preventing children from viewing content deemed inappropriate. The regulations also introduce safeguards to protect children's personal data from targeted advertising practices and platform features that may be addictive or psychologically harmful.
"The primary goal of these laws is to establish children"s privacy safeguards with respect to the design and structure of online-enabled technologies that minors interact with," Maureen Fulton, Chair of the Data Privacy and Security Practice Area at Koley Jessen, said. "The idea is to require technology companies to design platforms with built-in privacy safeguards that prioritize the well-being of children by limiting excess data collection and prohibiting design elements that may harm those children's privacy interests."
The U.K. Age-Appropriate Design Code, which took effect in 2021, introduced a set of standards for companies that process or collect children's personal data. Following its enactment, California introduced its own version, the California Age-Appropriate Design Code Act based on the U.K.'s framework.
However, the CAADCA has faced legal challenges. Industry group NetChoice filed a lawsuit arguing the law's content moderation requirements are overly vague and may lead to censorship. As a result, the U.S. District Court for the Northern District of California temporarily blocked the law's enforcement while litigation proceeds.
Nebraska's Online Child Safety Act, signed into law by Gov. Jim Pillen, R-Neb., in May, draws inspiration from both the California and U.K. models. Like those efforts, the law requires companies to assess and mitigate risks to children's privacy, mental health and overall safety.
"This code is important for Nebraskans and can serve as a model for other states wanting to codify protections for America's youth," the Nebraska Governor's Office told the IAPP. "The law requires social media and other online services to include design features that prevent compulsive use and psychological harm like anxiety and depression."
Vermont passed its Age-Appropriate Design Code in June, which introduces restrictions on digital services likely to be accessed by individuals under 18. The Vermont Kids Code also includes a requirement that covered businesses implement age-assurance measures to determine whether children are accessing certain content or features.
With ongoing legal challenges to the CAADCA, Vermont and Nebraska's laws could eventually face similar scrutiny. State Rep. Monique Priestley, D-Vt., said lawmakers closely monitored the California lawsuit while crafting their own bill. She emphasized that Vermont's law is not focused on restricting speech or content.
"We took a lot of care here to make sure that it was focused, not on content at all, but on safety features," Priestley said.
Nebraska's law also takes a different approach by focusing squarely on platform design rather than content regulation. "The Age-Appropriate Online Design Code Act is not an attempt to moderate content and limit free speech or stifle innovation but aims to protect the children of Nebraska and ensure that Big Tech social media companies aren’t taking advantage of kids," the Nebraska Governor's Office said. "Nebraska's law doesn’t say that minors can’t use these services or see certain content; rather, our goal is to ensure that our kids can safely interact with these apps."
As the laws move toward implementation, companies meeting the applicability thresholds will need to assess how their current practices align with the new requirements. Priestley said companies should view the codes as opportunities to build safer platforms, not simply regulatory burdens.
"I think it actually gives opportunities for companies to, in some cases, maybe rethink their business model," Priestley said.
A key step for organizations is determining whether they fall under the scope of either state law. Fulton recommends companies begin their "compliance efforts with an internal audit to determine precisely what categories of information are being collected from children, and how such information is being used/disclosed."
Nebraska's Age-Appropriate Design Code is set to take effect in July 2026, while Vermont's law will go into effect in January 2026.
Lexie White is a staff writer for the IAPP.
