Nebraska

A 2025 amendment (LB 383) revised the Act's definitions so that child sexual abuse material includes an obscene visual depiction of a computer-generated person who is, or would appear to a reasonable person to be, a child, whether or not any real child was used to produce the image. The Act defines computer-generated to include an image created, adapted, or modified using artificial intelligence.

Knowing possession or receipt of such material by a person nineteen or older is a Class IIA felony, by a person under nineteen a Class I misdemeanor rising to a Class IV felony on a second or later conviction, and a Class IC felony for anyone with a prior covered-offense conviction.

LB 77 (2025), the Ensuring Transparency in Prior Authorization Act, bars a utilization review agent's artificial intelligence-based algorithm from being the sole basis of a decision to deny, delay, or modify health care services based, in whole or in part, on medical necessity.

The agent must disclose to the Department of Insurance, to each health care provider in its network, to each enrollee, and on its public website whether artificial intelligence-based algorithms are used or will be used in the utilization review process. The department may audit, itself or through a third-party entity, the agent's automated utilization management system. These provisions became operative on January 1, 2026.

Beginning July 1, 2027, an operator of a conversational AI service must clearly and conspicuously disclose AI status to a minor account holder as a persistent disclaimer, and to any user a reasonable person could be misled into believing is human.

Operators must not use unpredictable engagement rewards to increase a minor's use of the service, must take reasonable measures to keep the service from producing sexual content involving or directed at a minor or claiming to be human or to provide professional mental-health care, and must adopt a suicide and self-harm referral protocol; the Attorney General enforces, and the Act creates no private right of action.

An individual or commercial entity conducting business in Nebraska that owns or licenses computerized data including personal information about a Nebraska resident must, upon becoming aware of a breach of security, conduct a reasonable and prompt investigation and, where notice is required, also notify the Attorney General no later than when notice is provided to the affected resident.

This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

NDPA governs private-sector processing of Nebraska residents' personal data. Enacted as part of omnibus Legislative Bill 1074 (108th Legislature), approved by the Governor April 17, 2024, effective January 1, 2025 per consistent secondary reporting; the enactment date is corroborated by the slip law's own title as reported, rather than independently confirmed against primary text. Controller and processor duties are allocated across sections 87-1107 to 87-1114.

NDPA gives a Nebraska consumer rights consistent with the other states researched in this batch, access, correction, deletion, a portable copy, and opt-out of targeted advertising, sale, and qualifying profiling, structure inferred from a cross-reference in the response-timing provision rather than independently pulled verbatim from the rights-granting section itself.

A controller must respond without undue delay and within 45 days after receipt of the request, with one 45-day extension available.

The Nebraska Attorney General has exclusive authority to enforce NDPA. Before bringing an action, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; no sunset date for this cure right appears in the text read, unlike Connecticut's and Delaware's time-limited cure windows or Montana's eliminated one. Civil penalties run up to $7,500 per violation, and the Act creates no private right of action.

NDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.

'Biometric data' means data generated to identify a specific individual through automatic measurement of a biological characteristic, including a fingerprint, voice print, retina image, or iris image, and is structured slightly differently in wording from the Connecticut, Oregon, Montana, and Delaware definitions (opening with the identification purpose rather than excluding then clawing back), but reaches the same operative result: a raw recording is excluded, except when generated to identify a specific individual.

Section 28-1343.01 provides that a person commits the offense of unauthorized computer access if the person intentionally and without authority penetrates a computer security system, with penalty tiers running from a Class II misdemeanor up to a Class IV felony depending on the risk created.

Section 28-1343(5) defines computer security system precisely as a program or device that is intended to protect the confidentiality and secrecy of data and information stored in or accessible through the computer system, and that either displays a conspicuous warning to a user that the user is entering a secure system or requires a person seeking access to knowingly respond by use of an authorized code to gain access.

Read together, a page with no login wall, no access code, and no conspicuous entry warning does not meet Nebraska's own statutory definition of a computer security system, so a plain crawl of such a page cannot, on the text, penetrate one, a materially clearer and more scraper-favorable authorization test than a bare without authorization formulation. No reported Nebraska case has applied this to scraping specifically, but the statutory text itself is the controlling authority.

Section 87-1102(28) excludes information lawfully made available through government records, or that a business has a reasonable basis to believe was lawfully made available to the public through widely distributed media, by a consumer, or by someone the consumer disclosed it to, unless the consumer has restricted the information to a specific audience, from the Act's definition of personal data.

Unusually, section 87-1103(1) applies the NDPA not by a consumer-count or revenue threshold but to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or sells personal data, and that is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, tying Nebraska's coverage to federal size standards that vary by industry rather than a fixed number.

Section 87-1103(2) exempts nonprofit organizations and institutions of higher education outright, beyond the standard state-agency, financial-institution, and Health Insurance Portability and Accountability Act (HIPAA)-covered-entity carve-outs, a broader nonprofit exemption than several peer states carry. Effective January 1, 2025, confirmed on the Nebraska Attorney General's official Data Privacy homepage. Enforcement is by the Nebraska Attorney General; there is no private right of action.

An individual or commercial entity that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information must implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of that information and to the nature, size, and resources of the business, including safeguards for disposal of the information.

Where the entity discloses that data to a nonaffiliated third-party service provider, it must require by contract that the provider maintain reasonable security procedures and practices of its own. The Act's own definition of a bound commercial entity reaches a government, governmental subdivision, agency, or instrumentality as well as a private business.

An entity that already complies with a state or federal law giving greater protection, or with the Gramm-Leach-Bliley Act Title V or Health Insurance Portability and Accountability Act (HIPAA) regulations where it is subject to either, is deemed to comply. Only the Attorney General enforces the duty, as a deemed violation of the Consumer Protection Act's unfair-practices section, and the section creates no private right of action.

Creates civil liability for a commercial entity that knowingly or intentionally publishes or distributes material harmful to minors on the internet, where such material makes up a substantial portion (more than one third) of the site's content, without performing reasonable age verification of Nebraska users.

Requires a covered online service (over $25 million in annual revenue that derives at least half its revenue from selling or sharing personal data) to give minors accessible controls over addictive design features such as infinite scroll and push notifications, default to the highest available privacy and safety settings, limit profiling and targeted advertising to minors, and restrict sharing of precise geolocation data.