Nebraska

A 2025 amendment (LB 383) revised the Act's definitions so that child sexual abuse material includes an obscene visual depiction of a computer-generated person who is, or would appear to a reasonable person to be, a child, whether or not any real child was used to produce the image. The Act defines computer-generated to include an image created, adapted, or modified using artificial intelligence.

Knowing possession or receipt of such material by a person nineteen or older is a Class IIA felony, by a person under nineteen a Class I misdemeanor rising to a Class IV felony on a second or later conviction, and a Class IC felony for anyone with a prior covered-offense conviction.

LB 383 carries no emergency clause, so this provision takes effect under Nebraska's general rule for a non-emergency act, three calendar months after the Legislature adjourns; the calendar day this produced for the 2025 session has not been located in an official record.

LB 77 (2025), the Ensuring Transparency in Prior Authorization Act, bars a utilization review agent's artificial intelligence-based algorithm from being the sole basis of a decision to deny, delay, or modify health care services based, in whole or in part, on medical necessity.

The agent must disclose to the Department of Insurance, to each health care provider in its network, to each enrollee, and on its public website whether artificial intelligence-based algorithms are used or will be used in the utilization review process. The department may audit, itself or through a third-party entity, the agent's automated utilization management system. These provisions became operative on January 1, 2026.

Beginning July 1, 2027, an operator of a conversational AI service must clearly and conspicuously disclose AI status to a minor account holder as a persistent disclaimer, and to any user a reasonable person could be misled into believing is human.

Operators must not use unpredictable engagement rewards to increase a minor's use of the service, must take reasonable measures to keep the service from producing sexual content involving or directed at a minor or claiming to be human or to provide professional mental-health care, and must adopt a suicide and self-harm referral protocol; the Attorney General enforces, and the Act creates no private right of action.

An individual or commercial entity conducting business in Nebraska that owns or licenses computerized data including personal information about a Nebraska resident must, upon becoming aware of a breach of security, conduct a reasonable and prompt investigation and, where notice is required, also notify the Attorney General no later than when notice is provided to the affected resident. The provisions this entry describes came into force on different days.

NDPA requires a controller to conduct and document a data protection assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to any consumer, the processing of sensitive data, and any processing activity that presents a heightened risk of harm to any consumer.

Each assessment must identify and weigh the direct or indirect benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards, and must factor in the use of deidentified data, the reasonable expectations of consumers, the context of the processing and the relationship between the controller and the consumer.

A controller must make an assessment requested under section 87-1121 available to the Attorney General pursuant to a civil investigative demand under that section. An assessment is confidential and exempt from disclosure as a public record, and disclosing one in compliance with a request from the Attorney General does not waive attorney-client privilege or work-product protection.

NDPA governs private-sector processing of Nebraska residents' personal data. Enacted as part of omnibus Legislative Bill 1074 (108th Legislature), approved by the Governor April 17, 2024. Sections 1 to 30 of Legislative Bill 1074 became operative on January 1, 2025. Controller and processor duties are allocated across sections 87-1107 to 87-1114.

NDPA requires the contract between a controller and a processor to require the processor to make available to the controller, on reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the requirements of the Act. The Nebraska Legislature's statute page gives Laws 2024, LB1074, section 15, as the source of section 87-1115. Sections 1 to 30 of Legislative Bill 1074 became operative on January 1, 2025.

Any genetic sequencing data that is utilized in Nebraska may not be stored within any foreign adversary country. No person may remotely access genetic sequencing data that is stored in Nebraska from a foreign adversary country.

The Nebraska Data Privacy Act gives a consumer the rights to access, correct and delete personal data, to obtain a portable copy, and to opt out of targeted advertising, sale and qualifying profiling. A controller must respond without undue delay and within 45 days after receipt of the request, with one 45-day extension available.

A patient may request a copy of the patient's medical records or request to examine them, and the request and any authorization must be in writing. A provider must furnish a copy not later than thirty days after the written request is received.

A provider that receives a written request to examine the records must, no later than ten days after receiving it, make the records available during regular business hours, tell the patient the records do not exist or cannot be found, name the provider that maintains them if known, or explain a delay and give a date not later than twenty-one days after the request.

Mental health medical records may be withheld if a treating physician, psychologist or mental health practitioner determines in professional opinion that release would not be in the best interest of the patient, unless a court order requires release.

The Act governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the Department of Insurance.

A licensee must give a customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the Act authorizes.

A licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and an opt-out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out. A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from that person, except for the insurance functions the Act lists.

The health information authorization requirement became operative on January 1, 2003. Each violation of the Act is an unfair trade practice in the business of insurance subject to the Unfair Insurance Trade Practices Act.

Under that Act the Director of Insurance may order a monetary penalty of not more than $1,000 for each violation, not to exceed an aggregate of $30,000, or up to $15,000 for each violation and $150,000 in aggregate where the violation was committed flagrantly in conscious disregard of that Act. The Act does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The Act took effect when approved on April 4, 2001.

The Nebraska Attorney General has exclusive authority to enforce NDPA. Before bringing an action, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; no sunset date for this cure right appears in the text read, unlike Connecticut's and Delaware's time-limited cure windows or Montana's eliminated one. Civil penalties run up to $7,500 per violation, and the Act creates no private right of action.

An employer, meaning a person which employs any individual within Nebraska as an employee, may not publicly post or publicly display in any manner more than the last four digits of an employee's social security number, including by making more than the last four digits available to the general public or to an employee's coworkers.

An employer may not require an employee to transmit more than the last four digits of the social security number over the Internet unless the connection is secure or the information is encrypted, or to use more than the last four digits to access an Internet website unless a password, unique personal identification number or other authentication device is also required.

An employer may not require an employee to use more than the last four digits of the social security number as an employee number for any type of employment-related activity.

An employer may use more than the last four digits only for compliance with state or federal law, for internal administrative purposes, and for commercial transactions the employee freely and voluntarily enters into with the employer, and six listed internal uses are not permitted, including use in files with unrestricted access within the company and for posting any type of company information.

An employer who violates the section is guilty of a Class V misdemeanor, and evidence of a conviction is admissible at a civil trial as evidence of the employer's negligence.

Except as federal law otherwise requires, an employer, meaning a person who has one or more employees, may not fail or refuse to hire, recruit or promote an employee or applicant because of genetic information that is unrelated to the ability to perform the duties of a particular job or position. An employer may not require an employee or applicant for employment to submit to a genetic test or to provide genetic information as a condition of employment or promotion.

An employee may voluntarily provide the employer genetic information related to the employee's health or safety in the workspace, and the employer may use it to protect the employee's health or safety. The section does not apply to the employment of an individual by his or her parent, spouse or child, and it excludes an individual employed in the domestic service of any person.

A direct-to-consumer genetic testing company must make available to a consumer a high-level privacy policy overview and a prominent, publicly available privacy notice.

A company must obtain a consumer's initial express consent to the uses of the genetic data, separate express consent for transferring or disclosing it to any person other than the company's vendors and service providers or for using it for other purposes, separate express consent for retaining a biological sample after the initial testing, informed consent under the Federal Policy for the Protection of Human Research Subjects for disclosure to third parties for research, and express consent for marketing based on the data.

A company must require a court order before disclosing genetic data to any government agency, including law enforcement, without the consumer's express written consent. A company must develop, implement and maintain a comprehensive security program to protect a consumer's genetic data and must provide a process for the consumer to access the data, delete the account and data, and obtain written documentation verifying destruction of the biological sample.

A company may not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent. The Attorney General may bring an action to enforce the Act, and a violation is subject to a civil penalty of $2,500 for each violation, in addition to actual damages incurred by the consumer and the costs and reasonable attorney's fees of the Attorney General.

No medical facility or research facility may use any genetic sequencer or operational and research software for genetic sequencing if the sequencer or software is produced in or by a foreign adversary, a state-owned enterprise of a foreign adversary, a business domiciled in a foreign adversary, or a subsidiary or affiliate of a business domiciled in a foreign adversary.

A medical facility or research facility in possession of such a genetic sequencer or software must permanently disable it or remove it from any facility associated with the medical facility or research facility.

A hospital, medical or surgical expense-incurred policy or certificate delivered, issued for delivery or renewed in Nebraska, and any self-funded employee benefit plan to the extent not preempted by federal law, may not require a covered person, a dependent, or an asymptomatic applicant for coverage or asymptomatic dependent to undergo any genetic test before issuing, renewing or continuing the policy or certificate.

The section does not prohibit requiring an applicant for coverage to answer questions concerning family history.

A genetic test under the section means the analysis of human DNA, RNA and chromosomes and those proteins and metabolites used to detect heritable or somatic disease-related genotypes or karyotypes for clinical purposes, and a routine physical examination or routine analysis of body fluids is not a genetic test unless conducted specifically to determine the presence, absence or mutation of a gene or chromosome.

NDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.

'Biometric data' means data generated to identify a specific individual through automatic measurement of a biological characteristic, including a fingerprint, voice print, retina image, or iris image, and is structured slightly differently in wording from the Connecticut, Oregon, Montana, and Delaware definitions (opening with the identification purpose rather than excluding then clawing back), but reaches the same operative result: a raw recording is excluded, except when generated to identify a specific individual.

An operator may not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, acquired through the use of its site, service or application for school purposes.

An operator may not knowingly use covered information to amass a profile about a student except in furtherance of school purposes, may not knowingly sell or rent a student's covered information, and may not knowingly disclose covered information except for the purposes the section lists.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and must delete a student's covered information within a reasonable time when the school or school district requests deletion, unless a student or parent or guardian consents to maintenance of the information. The section does not apply to general audience websites, services or applications.

Section 28-1343.01 provides that a person commits the offense of unauthorized computer access if the person intentionally and without authority penetrates a computer security system, with penalty tiers running from a Class II misdemeanor, where the offense compromises the security of data, up to a Class IV felony, where it creates a grave risk of causing a person's death.

Section 28-1343(5) defines computer security system precisely as a program or device that is intended to protect the confidentiality and secrecy of data and information stored in or accessible through the computer system, and that either displays a conspicuous warning to a user that the user is entering a secure system or requires a person seeking access to knowingly respond by use of an authorized code to gain access.

Taken together, a page with no login wall, no access code, and no conspicuous entry warning does not meet the definition of a computer security system, so a plain crawl of such a page does not penetrate one under this section.

Section 87-1102(28) defines publicly available information as information that is lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience, and section 87-1102(20)(b) excludes it from personal data.

Section 87-1103(1) applies the NDPA not by a consumer-count or revenue threshold but to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or sells personal data, and that is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024.

Section 87-1103(2) exempts nonprofit organizations and institutions of higher education, along with state agencies and political subdivisions, financial institutions, covered entities and business associates under the federal health privacy rules, and certain electric and gas utilities. Enforcement is by the Nebraska Attorney General; there is no private right of action. The act became operative on January 1, 2025.

An individual or commercial entity that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information must implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of that information and to the nature, size, and resources of the business, including safeguards for disposal of the information.

Where the entity discloses that data to a nonaffiliated third-party service provider, it must require by contract that the provider maintain reasonable security procedures and practices of its own. The Act's own definition of a bound commercial entity reaches a government, governmental subdivision, agency, or instrumentality as well as a private business.

An entity that already complies with a state or federal law giving greater protection, or with the Gramm-Leach-Bliley Act Title V or Health Insurance Portability and Accountability Act (HIPAA) regulations where it is subject to either, is deemed to comply. Only the Attorney General enforces the duty, as a deemed violation of the Consumer Protection Act's unfair-practices section, and the section creates no private right of action.

Creates civil liability for a commercial entity that knowingly or intentionally publishes or distributes material harmful to minors on the internet, where such material makes up a substantial portion (more than one third) of the site's content, without performing reasonable age verification of Nebraska users.

Requires a covered online service (over $25 million in annual revenue that derives at least half its revenue from selling or sharing personal data) to give minors accessible controls over addictive design features such as infinite scroll and push notifications, default to the highest available privacy and safety settings, limit profiling and targeted advertising to minors, and restrict sharing of precise geolocation data.

LB 838 was approved by the Governor on April 14, 2026. The sections of LB 838 that change the Act became operative three calendar months after the adjournment of the legislative session.

The definitions in section 87-1302 are operative as amended from July 18, 2026. As amended, a covered online service is a business that conducts business in Nebraska, generates a majority of its annual revenue from online services, determines the purposes and means of processing consumers' personal data, and either has annual gross revenue above $25 million or annually processes the personal data of 50,000 or more consumers, households, or devices.

Until July 18, 2026, the test required annual gross revenue above $25 million, annual purchase, receipt, sale or sharing of the personal data of 50,000 or more consumers, households, or devices, and at least 50 percent of annual revenue from the sale or sharing of personal data.

As amended, a covered design feature includes eleven listed features, among them infinite scroll, auto-playing video or audio, quantification of engagement, gamification, virtual currencies, and barriers to deleting an account. Until July 18, 2026, a covered design feature included five listed features: infinite scroll, rewards or incentives for frequency of visits or time spent, notifications or push alerts, in-game purchases, and appearance-altering filters.

As amended, the definition of a covered online service also excludes a financial institution subject to Title V of the Gramm-Leach-Bliley Act or any regulations adopted in accordance with that act.

Section 87-1304, as amended, is operative from July 18, 2026. As amended, section 87-1304(1) requires a covered online service to provide each covered minor with accessible and easy-to-use tools that limit who can communicate with the minor, prevent others from viewing the minor's personal data, and control design features, personalized recommendations, purchases and the sharing of precise geolocation information.

Until July 18, 2026, the lead-in to that subsection described tools that accomplish the following with respect to covered design features.

Section 87-1305, as amended, is operative from July 18, 2026. As amended, section 87-1305(2) provides that a covered online service that collects personal data of a user for age verification cannot use that data for other purposes. Until July 18, 2026, such a service also had to delete that personal data after use for age verification.

From July 18, 2026, section 87-1306(2) requires a covered online service to provide parents the listed abilities for an individual it knows to be a child or minor, and section 87-1306(3) requires it to notify a covered minor when any of the tools described in that section are in effect. Until July 18, 2026, section 87-1306(2) opened with the words with respect to covered design features, and section 87-1306(3) required notice of a covered design feature when any of the tools were in effect.

From July 18, 2026, section 87-1308(2) prohibits a covered online service from using dark patterns. Until July 18, 2026, section 87-1308(2) prohibited using dark patterns to subvert or impair covered minor autonomy, decision-making, or choice.

Section 87-1310, added by LB 838 and operative from July 18, 2026, prohibits a covered online service from providing a covered minor with a single setting that makes all of the default privacy settings less protective at once, and from requesting or prompting a covered minor to make privacy settings less protective unless the change is strictly necessary for a service or feature the minor has expressly and unambiguously requested.

Section 87-1311, also added by LB 838 and operative from July 18, 2026, requires a covered online service to provide a prominent, accessible, and responsive tool for a covered minor to request that the minor's account be unpublished or deleted, and to honor the request no later than fifteen days after receiving it.

Would require social media companies to verify the age of prospective account holders using a reasonable age verification method and to obtain a parent's express, verified consent before a minor may hold an account, with parental tools to view messages, control privacy settings, and limit time on the platform.