Privacy Law Library

Genetic Information Privacy Act

Nebraska GIPA

Genetic

Enacted by LB308 (2024), this law regulates consumer DNA testing companies. It requires privacy notices, layered express consent for uses, transfers, sample retention, research, and marketing, a comprehensive security program, and consumer rights to access and delete genetic data and have samples destroyed.

Where
Nebraska
Citation
Neb. Rev. Stat. 87-901 to 87-904
Status
In force
In force since
2024-07-19
Enforced by
Nebraska Attorney General
People can sue
No
Penalties
Civil penalty of $2,500 per violation, plus actual damages to the consumer and the Attorney General's costs and reasonable attorney's fees (87-903(3)).
Applies to
  • Direct-to-consumer genetic testing companies that offer genetic testing products or services directly to Nebraska consumers, or that collect, use, or analyze genetic data from such products provided by a consumer (87-902(2)-(3))
  • Excludes entities solely engaged in regulated human subjects research, and HIPAA protected health information held by covered entities and business associates (87-902(3), 87-904)

What a privacy notice must say

  • Provide a high-level privacy policy overview and a prominent, publicly available privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention, and deletion of genetic data.Neb. Rev. Stat. 87-903(1)(a)

Rights it gives people

  • Consumers may access their genetic data, delete their account and genetic data, and obtain written verification that their biological sample was destroyed.Neb. Rev. Stat. 87-903(1)(e)

Practices it requires

  • Obtain initial express consent describing intended uses, who can access results, and how data may be shared.Neb. Rev. Stat. 87-903(1)(b)(i)
  • Obtain separate express consent to transfer or disclose genetic data beyond vendors and service providers, to use it for new purposes, and to retain the biological sample after testing.Neb. Rev. Stat. 87-903(1)(b)(ii)-(iii)
  • Obtain Common Rule informed consent for research transfers or company research, and express consent for marketing based on genetic data.Neb. Rev. Stat. 87-903(1)(b)(iv)-(v)
  • Require a court order before disclosing genetic data to any government agency, including law enforcement, absent the consumer's express written consent.Neb. Rev. Stat. 87-903(1)(c)
  • Do not disclose genetic data to health, life, or long-term care insurers or to the consumer's employer without written consent.Neb. Rev. Stat. 87-903(2)

Security duties

  • Develop, implement, and maintain a comprehensive security program to protect genetic data.Neb. Rev. Stat. 87-903(1)(d)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.