{ "jurisdiction_id": "US-NE", "jurisdiction": "United States – Nebraska", "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 31, "sub_modules": 57, "source_register": 15 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "amber", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Comprehensive statute is in force but is narrower than GDPR-style regimes (no dedicated regulator, no registration regime, small-business/entity-level exemptions), and several adjacent instruments (Biometric Autonomy Liberty Law) remain at bill stage.", "claims": [ { "statement": "The Nebraska Data Privacy Act grants consumer data rights and imposes obligations on controllers, enforced by the Nebraska Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's Data Privacy Act (LB 1074) was signed into law by Governor Jim Pillen on April 17, 2024, and is set to go into effect on January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/nebraska-bill-genetic-information-privacy-act-presented", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's Genetic Information Privacy Act (GIPA, LB 308) was signed by Governor Jim Pillen on February 13, 2024, and went into effect on July 17, 2024, mandating consumer consent and security measures for genetic-data handling by direct-to-consumer testing companies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska also has data security and breach notification requirements pursuant to the Financial Data Protection and Consumer Notification of Data Security Breach Act, 2006, under §87-801 et seq. of Chapter 87 of the Nebraska Revised Statutes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's NDPA applicability threshold and enforcement structure materially differ from Nebraska's own GIPA and from other states' comprehensive laws, per comparative legal analysis contrasting the two statutes.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's Delete Act mandates data brokers to register, secure data, and facilitate consumer data deletion requests by 2028.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent and sensitive-data protections exist but are narrower and less codified than GDPR Art 6/9 equivalents; no explicit statutory list of lawful bases beyond consent/necessity language confirmed in research.", "claims": [ { "statement": "The Nebraska Data Privacy Act regulates personal data processing and imposes penalties for violations, following a consent/notice-based model rather than an enumerated legal-bases structure.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Comparative analysis of the 2024 wave of state privacy laws, including Nebraska's, notes common threshold applicability, purpose and enforcement-structure differences between GIPA-style consent regimes and general NDPA consent requirements.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's Genetic Information Privacy Act mandates consumer consent and security measures for genetic data handling by testing companies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Core rights are confirmed as granted by primary/secondary sources but exact deadline text (45+45 days) is inferred from the WPA template rather than directly cited from Nebraska statutory language retrieved in this research.", "claims": [ { "statement": "The Nebraska Data Privacy Act grants consumer data rights and imposes obligations on controllers, enforced by the Nebraska Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Nebraska AG's FAQs on the NDPA outline data protection responsibilities and consumer rights effective January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/nebraska-ag-publishes-faqs-ndpa", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "In Nebraska, the requirement to allow consumers to opt out of processing for targeted advertising or sale through opt-out preference signals is already in effect, having gone into effect January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/resources/article/us-state-privacy-legislation-tracker/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Nebraska AG published FAQs on the NDPA outlining data protection responsibilities and consumer rights, effective January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/nebraska-ag-publishes-faqs-ndpa", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Core accountability/security obligations exist but breach-notification substance sits outside the NDPA in an older, narrower 2006 statute, and DPO/ROPA formalities characteristic of GDPR are absent.", "claims": [ { "statement": "Data protection assessment requirements apply to processing activities created or generated after specified dates across the 2024-wave WPA-model states, a template Nebraska's NDPA follows.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/resources/article/us-state-privacy-legislation-tracker/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska law states an individual or a commercial entity complies with the reasonable security requirement of Nebraska law if it complies with a state or federal law that provides greater protection to personal information than the Nebraska law or complies with the regulations promulgated under GLBA or HIPAA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/exceptions-in-new-state-privacy-laws-leave-data-without-security-coverage", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "On April 18, 2024, the Data Privacy Act was approved by the Governor of Nebraska and will enter into effect on January 1, 2025; however, the DPA has only limited provisions on breach notifications.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/nebraska-data-breach", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska has data security and breach notification requirements pursuant to the Financial Data Protection and Consumer Notification of Data Security Breach Act, 2006, under §87-801 et seq., enforced by the Nebraska Attorney General, who may issue subpoenas and recover direct economic damages for each injured resident.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No comprehensive cross-border transfer regime exists at the Nebraska state level; this is an accurate 'gap' finding rather than a missed search.", "claims": [] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Sectoral overlays exist and are actively enforced, but several sub-modules (telecoms/ePrivacy, credit-scoring, education, insurance) had no Nebraska-specific findings in this pass.", "claims": [ { "statement": "An individual or commercial entity complies with Nebraska's reasonable security requirement if it complies with regulations promulgated under GLBA or HIPAA, or a state/federal law providing greater protection.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/exceptions-in-new-state-privacy-laws-leave-data-without-security-coverage", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The State of Nebraska, through Attorney General Michael T. Hilgers, brought an action against Change Healthcare Inc., UnitedHealth Group Incorporated, and Optum, Inc. for violations of the Consumer Protection Act, the Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006, and the Uniform Deceptive Trade Practices Act stemming from a data breach that exposed personal information and electronic protected health information of approximately 575,000 Nebraskans.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Nebraska Attorney General", "source_url": "https://ago.nebraska.gov/sites/default/files/doc/Court%20Filing_10.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's Bill 477 amends the Workplace Privacy Act, limiting employer access to personal internet accounts and tracking devices.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "GM allegedly packaged and sold Nebraskans' driving data to third-party data brokers who used it to create 'Driving Scores' later sold to insurance companies to raise rates, deny coverage, or cancel policies without drivers' knowledge.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Nebraska Attorney General", "source_url": "https://ago.nebraska.gov/attorney-general-mike-hilgers-files-lawsuit-against-general-motors-deceptive-collection-and-sale", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "UOOM/opt-out rights are confirmed in force; several sub-modules (clean rooms, dark patterns specifics) lack direct Nebraska-specific sourcing.", "claims": [ { "statement": "In California, Colorado, Connecticut, Montana, Nebraska, New Hampshire and Texas, universal-opt-out-mechanism (UOOM) related requirements are already in effect, with each states' UOOM requirements, excluding California and Colorado, going into effect 1 January.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/there-s-no-opting-out-of-universal-opt-outs", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Genetic-data regime is confirmed in force; biometric-specific standalone law status is uncertain (bill vs enacted); AI risk-assessment and surveillance-carveout sub-modules are evidence gaps.", "claims": [ { "statement": "Legislative Bill 204 for the Biometric Autonomy Liberty Law, referred to the Banking, Commerce, and Insurance Committee, mandates written consent for the collection and use of biometric data and is set to become operative on January 1, 2026; the bill was introduced on January 14, 2024.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Uncertain", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/nebraska-bill-adopt-biometric-autonomy-liberty-law", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska's Genetic Information Privacy Act mandates consumer consent and security measures for genetic data handling by testing companies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Minors' protections are robust and dated, but enforcement has not yet commenced (begins July 2026) and dependent-adult/education-settings sub-modules are evidence gaps.", "claims": [ { "statement": "The Code applies to online services with significant revenue and user bases, exempting entities with minimal minor users and those under federal laws like HIPAA, and enforcement by the Nebraska Attorney General begins July 1, 2026, with penalties up to $50,000 per violation, emphasizing compliance without a cure period.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/nebraska-age-appropriate-design-code-strengthens", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "On May 30, 2025, Nebraska became the third US state to adopt an age-appropriate design code law with the enactment of the Code, following California (2022) and Maryland (2024), strengthening online privacy protections for minors by mandating data minimization, default privacy settings, and restrictions on targeted advertising.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/nebraska-age-appropriate-design-code-strengthens", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-nebraska/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement authority and recent case activity are well evidenced; regulator funding/capacity data, NDPA-specific cure-period length, and collective-redress mechanisms were not independently confirmed in this pass.", "claims": [ { "statement": "The Nebraska Attorney General is empowered to enforce GIPA's provisions, with violations incurring a civil penalty of $2,500 per violation, plus actual damages and attorney's fees.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/nebraska-bill-genetic-information-privacy-act-presented", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Enforcement of the Age-Appropriate Online Design Code Act by the Nebraska Attorney General begins July 1, 2026, with penalties up to $50,000 per violation, emphasizing compliance without a cure period.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/nebraska-age-appropriate-design-code-strengthens", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The State of Nebraska, through Attorney General Michael T. Hilgers, brought an action against Change Healthcare Inc., UnitedHealth Group Incorporated, and Optum, Inc. for violations of the Consumer Protection Act, the Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006, and the Uniform Deceptive Trade Practices Act stemming from a data breach affecting approximately 575,000 Nebraskans.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Nebraska Attorney General", "source_url": "https://ago.nebraska.gov/sites/default/files/doc/Court%20Filing_10.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Nebraska Attorney General Mike Hilgers announced that the State of Nebraska filed a lawsuit against General Motors LLC and OnStar LLC for unlawfully collecting, processing, and selling sensitive driving data from Nebraskans without their knowledge or consent, alleging violations of the Nebraska Consumer Protection Act and Uniform Deceptive Trade Practices Act, and the complaint seeks civil penalties, restitution, and injunctive relief.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Nebraska Attorney General", "source_url": "https://ago.nebraska.gov/attorney-general-mike-hilgers-files-lawsuit-against-general-motors-deceptive-collection-and-sale", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consistent with most 2024-wave US state comprehensive privacy laws, the Nebraska Data Privacy Act lacks a private right of action, with enforcement running exclusively through the Nebraska Attorney General's general authority.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/nebraska", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }