Student Online Personal Protection Act
Nebraska SOPPA
Students · Children · Data security · Marketing
Nebraska's version of the SOPIPA model law restricts K-12 edtech operators' use of student data. Operators may not use covered student information for targeted advertising or non-school profiles, may not sell or rent it, may disclose it only for listed purposes, and must secure it and delete it on a school's request.
- Where
- Nebraska
- Citation
- Neb. Rev. Stat. 79-2,153 to 79-2,155
- Status
- In force
- In force since
- 2017-09-01
- Enforced by
- No enforcement provision stated in the act
- People can sue
- No
- Penalties
- The act states no penalty or enforcement mechanism.
- Applies to
- Operators of websites, online services, and apps with actual knowledge that the service is used primarily for, and was designed and marketed for, elementary, middle, or high school purposes (79-2,154(4))
- Excludes services operated by postsecondary institutions with a physical presence in Nebraska and general audience services (79-2,154(4), 79-2,155(6)(c))
Practices it requires
- Do not engage in targeted advertising based on information acquired through the K-12 service, or amass student profiles except for school purposes.Neb. Rev. Stat. 79-2,155(1)(a)-(b)
- Do not sell or rent a student's covered information (limited exceptions for acquisitions and consented national assessment providers).Neb. Rev. Stat. 79-2,155(1)(c)
- Disclose covered information only for listed purposes such as school purposes, legal compliance, judicial process, safety or security, student-requested purposes, or to contractually bound service providers.Neb. Rev. Stat. 79-2,155(1)(d)
- Delete a student's covered information within a reasonable time when the school or district requests, unless the student or parent consents to keep it.Neb. Rev. Stat. 79-2,155(3)(b)
Security duties
- Implement and maintain reasonable security procedures appropriate to the covered information.Neb. Rev. Stat. 79-2,155(3)(a)
Other duties
- Service provider contracts must bar recipients from using covered information beyond the contracted service or redisclosing it and must require reasonable security.Neb. Rev. Stat. 79-2,155(1)(d)(vi)
Sources
- Official text
- Neb. Rev. Stat. 79-2,153 (Nebraska Legislature)
- Neb. Rev. Stat. 79-2,154 (Nebraska Legislature)
- Neb. Rev. Stat. 79-2,155 (Nebraska Legislature)
- Revisor cross-reference table of effective dates, 2017 session (LB512 secs. 1-4 operative September 1, 2017)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Research reference, not legal advice.