Nebraska

    •  

Code/Regulations

Effective Date: January 1, 2025

Details

Threshold

Applies only to a person that:

(a) Conducts business in this state or produces a product or service consumed by residents of this state;

(b) Processes or engages in the sale of personal data; AND

(c) Is not a small business as determined under the federal Small Business Act (SBA)

Definition of "Personal Data"

Any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual, and includes pseudonymous data when the data is used by a controller or processor in conjunction with additional information that reasonably links the data to an identified or identifiable individual.

Definition of "Sensitive Personal Information"

As with all state general privacy laws, includes the following Personal Data:

  • Race or ethnic origin;
  • Religious beliefs;
  • Citizenship or immigration status;
  • Genetic data;
  • Biometric data;
  • Physical or mental health diagnosis; and
  • Sexual orientation.

In addition, Nebraska’s definition also includes:

  • Precise geolocation data; and
  • Personal data collected from a known child.

Definition of "Sale"

Means the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

Data-Protection Assessments

Required for targeted advertising; sale of personal data; certain profiling,

Unfair or deceptive treatment, financial, physical, or reputational injury to any consumer;

other substantial injury to any consumer;

Opt-In Consent Required for Processing Sensitive Data 

Yes

Consumer Rights to Confirm Processing, Request Access, Correction, Deletion & Portability

Yes

Consumer Right to Opt Out of Sale

Yes

Consumer Right to Opt Out of Targeted Ads/Sharing

Yes

Consumer Right to Opt Out of Profiling

Yes

Pseudonymous Data Exempt from Consumer Requests

Yes, in some cases

Appeal Rights

Yes

Universal Opt-Out Mechanism Required Recognition/Date

None

Data of Minors

Process personal data of a known child in accordance with COPPA

GLBA Exemption

Yes (Both entity and data level)

HIPAA Exemption

Yes (Entity and data level)

Applies/Does Not Apply to Personal Information in a Commercial or Employment Context

Does not apply to commercial or employment context; applies in an individual or household context

Nonprofit Exemption

Yes

Private Right of Action

No

Cure Period

30 Days

Cure Period Expiration

None

Enforcement Authority/Damages

Attorney General/up to $7,500 per violation

Disclaimer: States may periodically amend their laws and regulations and such amendments may affect or modify certain legal requirements or compliance obligations. There is no guarantee that this research is up to date as laws and regulations in the state consumer data privacy space continue to evolve. You should consult an attorney to assess the applicability of any existing, new, or proposed state consumer data privacy laws. By accessing this site, you acknowledge your understanding that the underlying content is not a replacement for legal counsel and does not constitute legal advice.