State Mix of Kids Online Safety Rules Muddies Compliance (1)

Recent “kids code” legislation passed by Vermont and Nebraska threatens companies with new compliance hurdles.

Both the Nebraska Age-Appropriate Design Code Act and Vermont Age-Appropriate Design Code Act protect the covered data of minors under 18 and limit the types of design features companies can use on underage audiences. The Nebraska code was signed into law by Gov. Jim Pillen (R) on May 30 and goes into effect in Jan. 2026. The Vermont code, if approved by the Gov. Phil Scott (R), not go into effect until January 2027.

The bills, which also set baseline privacy protections for kids, mark an evolution from California’s first-in-the-nation Age-Appropriate Design Act, which in turn drew inspiration from the UK Childrens Code. Vermont and Nebraska have gotten rid of requirements for companies to assess which specific pieces of content are harmful to kids, one of the parts of the California law and a subsequent Maryland copycat that spurred legal challenges. California is currently enjoined from enforcing its law.

Unlike the Childrens’ Online Privacy Protection Act, a federal law that is meant solely to protect the online privacy of children under 13, the new wave of kids codes aim at addressing a broad range of online harms. The state regulatory patchwork could become even more unwieldy as more states explore kids codes. New Mexico, Minnesota, South Carolina and Illinois have all introduced legislation to adopt similar models.

“Anyone who is working in the kids’ space is going to have to align different requirements.” said Claire Quinn, chief privacy officer at PRIVO, a kids privacy compliance tools provider.

How They Work

“The kids codes are trying to look at things more holistically,” said Bailey Sanchez, deputy director with the Future of Privacy Forum’s U.S. legislation team. “They’re not just about data privacy.”

The latest round of bills, which follow California’s code as well as a Maryland take on the law last year, represent a third-wave approach to legislation that has endured strong attacks from Big Tech critics.

Nebraska and Vermont both take their own unique approach to a design code. Nebraska requires tools for parents such as the ability to view and limit total screen time, while Vermont doesn’t. Vermont, unlike Nebraska, requires extensive transparency requirements for algorithmic recommendation systems—a potential concern for businesses seeking to protect trade secrets, Quinn said.

Further complicating matters, the two states outline different requirements for the hours in which push notifications can’t be sent to kids.

“Both Nebraska and Vermont have some very prescriptive approaches,” said Sanchez. “You would really have to make yourself a checklist.”

Vermont’s law gives authority to the attorney general to create additional rules and regulations which will “greatly change” what businesses need to do to comply, said Megan Stokes, state policy director of the Computer & Communications Industry Association.

That includes rulemaking around Vermont’s required “age assurance” safeguards, which could potentially include requiring a government ID. The law requires companies to determine user age—but it doesn’t prescribe a specific method for doing so.

Both the Nebraska law and Vermont legislation impose compliance burdens that may force companies to rethink their products, said Amy Lawrence, chief privacy officer and head of legal at marketing technology company SuperAwesome.

There is also some confusion about which companies are covered by the legislation. Vermont’s legislation covers businesses operating in the state that generate a majority of their annual revenue from online services. Nebraska’s law covers companies that conduct business in the state, have greater than $25 million in annual revenue, and derive more than 50% of their annual revenue from selling or sharing data. Both acts have carve-outs for data already covered by federal laws protecting financial and covered health data.( California covers any services “reasonably likely” to be accessed by children. Maryland shares the same thresholds as Nebraska. )

That leaves a wide range of businesses that don’t rely on online data sales but still provide online experiences for children, such as online clubs, Lawrence said.

Legal Worries

Companies will likely follow the “high-water mark” and comply with the strongest state laws, Lawrence said . Ongoing court battles in Maryland and California, however, make it unclear what that may be.

And there may yet be legal challenges to Nebraska and Vermont. Tech industry groups argue that the new kids design codes raise First Amendment concerns. The Computer & Communications Industry Association. is one of several tech industry groups urging Vermont Gov. Scott to veto the bill. The Republican governor had already raised concerns about a version of the bill introduced last year.

The Vermont governor’s office confirmed Friday he had not yet received the bill for review.

“We’re hopeful this legislation will mitigate concerns raised and look forward to reviewing the legislation when it reaches the Governor’s desk,” Amanda Wheeler, the governor’s press secretary, wrote in an email. “But I want to be clear, the Governor has not conclusively determined what action he will take on the bill.”

Other states may be waiting to see how legal challenges in Maryland and California play out before pursuing their own kids’ codes, Quinn said, but businesses shouldn’t wait to adjust their practices.

“There is definitely an understanding that they’re coming,” she said. “Regardless of if they’re enjoined, we’re going to see another and another one. There’s no getting away from the fact today that the regulators are coming for you.”