Comprehensive state privacy law
Nebraska privacy law
Nebraska Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Neb. Rev. Stat. §§ 87-1101 to 87-1130
- Enacted
- April 17, 2024. Laws 2024, LB 1074, sections 1 to 30, approved by the Governor 17 April 2024
- In force
- January 1, 2025
- Effective dates
- January 1, 2025: whole Data Privacy Act (LB 1074, section 100 makes sections 1 to 30 operative on this date)
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. The Act may not be read as a basis for a private right of action under the Act or any other law (§ 87-1125).
- Cure period
- 30 days. Before suing, the Attorney General must give written notice at least 30 days ahead. No action may be brought if the controller or processor cures within that time and gives a written statement with supporting documents plus an express statement that the violation will not recur. The cure right is permanent. (§ 87-1122)
- Rulemaking
- No. The Act grants no rulemaking power. The Attorney General must post guidance on controller, processor and consumer rights and an online complaint mechanism (§ 87-1120).
Amendments
No amendments recorded.
Topics
- ApplicabilityNebraska uses no numeric threshold. The Act applies to any person that does business in Nebraska or produces a product or service consumed by its residents, processes or sells personal data, and is not a small business under the federal Small Business Act (the same approach as Texas). Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, nonprofits, institutions of higher education and certain utilities are excluded at entity level, and many data types are exempt, including employment-context data.
- Consumer rightsConsumers may confirm and access their data, correct it, delete it, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant-effect profiling. Controllers must answer within 45 days, extendable once by 45 days with notice, and responses are free up to twice a year. Appeals must be decided in writing within 60 days, with a way to complain to the Attorney General if denied. Controllers must offer at least two request methods.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child (under 13), and precise geolocation within 1,750 feet. Controllers must obtain consent before processing sensitive data, and must follow COPPA for a known child. Every business, including small businesses, needs prior consent to sell sensitive data. There is no separate teen rule.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process data for incompatible purposes without consent. The privacy notice must list data categories (including sensitive data), purposes, how to exercise and appeal rights, data and third-party categories shared, and the request methods; sale and targeted advertising must be disclosed separately. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing. Consumers may use an authorized agent, including a browser setting or global device setting, to opt out of targeted advertising and sale, subject to stated exceptions.
- ProcessorsProcessors must follow controller instructions and help with rights requests, security and breach notification, and data protection assessments. The contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, deletion or return, compliance information, assessments and written flow-down to subcontractors. A processor may instead arrange an independent assessment.
- EnforcementThe Attorney General has exclusive enforcement authority and may issue civil investigative demands, including for data protection assessments. A permanent 30-day cure period applies before any action. Violations after the cure period, or breach of the written statement, carry civil penalties of up to $7,500 per violation, with injunctions and fees available. There is no private right of action.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Nebraska statute
Reference material, not legal advice.