Nebraska (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Data Privacy Act | Neb. Rev. Stat. 87-1101 to 87-1130 (Laws 2024, LB 1074) | In force | 1 January 2025 |
| Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006 | Neb. Rev. Stat. 87-801 to 87-808 (Laws 2006, LB 876) | In force | 14 July 2006 |
| Age-Appropriate Online Design Code Act | Neb. Rev. Stat. 87-1301 to 87-1311 (Laws 2025, LB 504; Laws 2026, LB 838) | In force | 1 January 2026 |
| Parental Rights in Social Media Act | Neb. Rev. Stat. 86-1701 to 86-1705 (Laws 2025, LB 383) | In force | 1 July 2026 |
| Conversational Artificial Intelligence Safety Act | Neb. Rev. Stat. 86-1801 to 86-1807 (Laws 2026, LB 525) | Enacted, not yet in force | 1 July 2027 |
| Agricultural Data Privacy Act | Neb. Rev. Stat. 87-1401 to 87-1410 (Laws 2026, LB 525) | In force | 18 July 2026 |
- Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006: Section 58 of LB 876 made the breach sections operative three calendar months after the 2006 session adjourned.
- Age-Appropriate Online Design Code Act: LB 838 widened which services are covered and added duties from 18 July 2026. The Attorney General can seek civil penalties from 1 July 2026.
- Parental Rights in Social Media Act: Challenged in NetChoice v. Hilgers (D. Neb. No. 4:26-cv-3149). The plaintiff’s published copy of the court’s order of 27 June 2026 shows a preliminary injunction against the age-verification and parental-consent duties (LB 383 § 28(1)(a) and (2)); the duty to let parents view a minor’s posts and messages, and the rest of the Act, may still be enforced. We couldn’t open an official copy, so check the court record, and any appeal, before relying on this.
- Agricultural Data Privacy Act: For farm data. Selling agricultural data needs the producer’s separate written consent, and new contracts from 1 January 2027 must say so.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to anyone doing business in Nebraska, or making products used by residents, who processes or sells personal data and isn’t a small business under the federal SBA standard. There’s no consumer-count threshold. Small businesses still need consent to sell sensitive data. Non-profits, colleges, the state, GLBA financial institutions, HIPAA-regulated bodies and some utilities are exempt. Employees and B2B contacts aren’t consumers.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · protectthegoodlife.nebraska.gov/data-privacy-homepage
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data and to opt out of targeted advertising, sale and profiling for significant decisions, within 45 days (extendable once by 45). Sensitive data needs opt-in consent. Offer at least two ways to make requests, including one on your website if you have one.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Consent age for online services
Section titled “Consent age for online services”A child is under 13. A known child’s sensitive data must be processed as COPPA requires, and a parent or guardian exercises the child’s rights. The privacy act has no teen rule; the design code and the social media act add rules for minors under 18 (see children).
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Children
Section titled “Children”Since 18 July 2026 the design code covers online businesses earning most revenue online with over $25 million revenue or data of 50,000+ people. For known minors they need high-privacy defaults, minimal data, no targeted ads, no night or school-hour notifications, parental tools and account deletion within 15 days. The social media act requires age checks, parental consent and supervision tools for under-18 accounts opened from 1 July 2026, but the plaintiff’s copy of a court order of 27 June 2026 shows the age-check and consent duties blocked for now (see laws).
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Leads, not sources: netchoice.org/wp-content/uploads/2026/06/NE_Granting-PI-in-Part-and-D…
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. If you sell data or use it for targeted advertising, say so clearly and explain how to opt out. Consumers can opt out through an authorised agent, including a browser setting or device signal such as Global Privacy Control. Honour it if you can verify the consumer, unless an exception applies, such as not processing such signals under other states’ laws.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Electronic marketing
Section titled “Electronic marketing”Automated dialling-announcing devices used for telephone sales need a Public Service Commission permit, and their calls to homes are limited to 8 a.m. to 9 p.m. Unsolicited fax ads are banned. Buyers can cancel a telephone sale until midnight of the fifth business day after written notice of that right, unless the seller offers at least 7 days to review and return. The design code bars ads for products such as tobacco, alcohol and gambling to known minors. Email and text marketing otherwise follow federal CAN-SPAM and the TCPA.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Breach notification
Section titled “Breach notification”After a prompt, good-faith investigation, notify affected Nebraska residents as soon as possible and without unreasonable delay if misuse has occurred or is reasonably likely. Notify the Attorney General no later than the residents, whatever the number affected. Since 2025, a private business can’t be held liable in a class action over a cybersecurity event unless it was wilful, wanton or grossly negligent.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/FloorDocs/99/PDF/Slip/LB876.pdf
Registration and fees
Section titled “Registration and fees”The privacy law has no registration or fee, and we found no Nebraska data broker registry. Automated dialling devices for telephone sales need a Public Service Commission permit.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Data protection officer
Section titled “Data protection officer”The privacy act has no data protection officer duty. A service covered by the design code must name one or more officers responsible for complying with it.
Sources: nebraskalegislature.gov/laws/statutes.php
International transfers
Section titled “International transfers”No cross-border transfer rules (federal rules are in us-federal). Processors must work under a contract that sets instructions, confidentiality, deletion and audit terms.
Sources: nebraskalegislature.gov/laws/statutes.php
Impact assessments
Section titled “Impact assessments”Controllers must document an assessment of targeted advertising, sale, sensitive data, risky profiling and any other high-risk processing, weighing benefits against risks. The Attorney General can obtain assessments through a civil investigative demand; they stay confidential.
Sources: nebraskalegislature.gov/laws/statutes.php
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of solely automated profiling for decisions with legal or similarly significant effects. From 1 July 2027, public chatbots built mainly to simulate conversation (excluding, for example, customer-service, business-use, narrow-topic, built-in and voice-assistant bots) must disclose AI to anyone who could be misled, have a self-harm protocol and not claim to give mental health care. For users known or reasonably certain to be under 18, they must also disclose AI, take reasonable measures against sexual content and human-like claims, and offer privacy tools.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
Penalties
Section titled “Penalties”Only the Attorney General enforces. A 30-day notice and cure applies before any action, with no end date. Civil penalties are up to $7,500 per violation, plus injunctions and costs. There’s no private right of action. Design code violations can cost up to $50,000 each, and social media act violations up to $2,500 each, with a private right of action for actual damages. From 1 July 2027, chatbot violations cost $1,000 or more each, up to $500,000 per operator, enforced by the AG only.
Sources: nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php · nebraskalegislature.gov/laws/statutes.php
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ne.yaml.