Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Adult content age verification (AV)
Creates civil liability for a commercial entity that knowingly or intentionally publishes or distributes material harmful to minors on the internet, where such material makes up a substantial portion (more than one third) of the site's content, without performing reasonable age verification of Nebraska users.
Note and primary source →
Age-appropriate design code
Requires a covered online service (over $25 million in annual revenue that derives at least half its revenue from selling or sharing personal data) to give minors accessible controls over addictive design features such as infinite scroll and push notifications, default to the highest available privacy and safety settings, limit profiling and targeted advertising to minors, and restrict sharing of precise geolocation data.
Note and primary source →
Broadens which businesses count as a covered online service under the Age-Appropriate Online Design Code Act, applying it to a business that derives a majority of its annual revenue from online services and either has more than $25 million in annual revenue or processes the personal data of 50,000 or more consumers, households, or devices. Approved by the Governor on April 14, 2026; the design code sections become operative July 18, 2026, three calendar months after the session's adjournment.
Note and primary source →
Breach notification
cite Neb. Rev. Stat. § 87-803
stage IMMINENT commencement not set
source official Nebraska statute text, Neb. Rev. Stat. § 87-803
An individual or commercial entity conducting business in Nebraska that owns or licenses computerized data including personal information about a Nebraska resident must, upon becoming aware of a breach of security, conduct a reasonable and prompt investigation and, where notice is required, also notify the Attorney General no later than when notice is provided to the affected resident.
This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.
What it asks of an app →
Comprehensive regime
NDPA governs private-sector processing of Nebraska residents' personal data. Enacted as part of omnibus Legislative Bill 1074 (108th Legislature), approved by the Governor April 17, 2024, effective January 1, 2025 per consistent secondary reporting; the enactment date is corroborated by the slip law's own title as reported, rather than independently fetched through the reader in this pass. Controller and processor duties are allocated across sections 87-1107 to 87-1114.
What it asks of an app →
Data subject rights
cite Neb. Rev. Stat. § 87-1108
stage IN FORCE in force since 2025-01-01
source official Nebraska statute text, Neb. Rev. Stat. § 87-1108
NDPA gives a Nebraska consumer rights consistent with the other states researched in this batch, access, correction, deletion, a portable copy, and opt-out of targeted advertising, sale, and qualifying profiling, structure inferred from a cross-reference in the response-timing provision rather than independently pulled verbatim from the rights-granting section itself in this pass.
A controller must respond without undue delay and within 45 days after receipt of the request, with one 45-day extension available.
What it asks of an app →
Enforcement supervision
The Nebraska Attorney General has exclusive authority to enforce NDPA. Before bringing an action, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; no sunset date for this cure right appears in the text read, unlike Connecticut's and Delaware's time-limited cure windows or Montana's eliminated one. Civil penalties run up to $7,500 per violation, and the Act creates no private right of action.
What it asks of an app →
Sensitive categories
NDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.
'Biometric data' means data generated to identify a specific individual through automatic measurement of a biological characteristic, including a fingerprint, voice print, retina image, or iris image, and is structured slightly differently in wording from the Connecticut, Oregon, Montana, and Delaware definitions (opening with the identification purpose rather than excluding then clawing back), but reaches the same operative result: a raw recording is excluded, except when generated to identify a specific individual.
What it asks of an app →
Social media and minors
Would require social media companies to verify the age of prospective account holders using a reasonable age verification method and to obtain a parent's express, verified consent before a minor may hold an account, with parental tools to view messages, control privacy settings, and limit time on the platform.
Note and primary source →
