NEBRASKA ENACTS FIRST OF ITS KIND AGRICULTURAL DATA PRIVACY ACT: KEY OBLIGATIONS, TIMELINES, AND COMPLIANCE STEPS

On April 14, 2026, Nebraska's Governor signed Legislative Bill 525 ("LB525"), which adopts the Agricultural Data Privacy Act (the "Act"). The Act – a first of its kind in the United States – is based on the idea that the agricultural producer is the owner and has control of agricultural data originating from the producer’s farm, land, device, or equipment. To put this concept into practice, the Act establishes new consent, contracting, and security obligations for businesses that collect, process, or sell such agricultural data. Below, we provide an overview of the key aspects of the Act, beginning with the applicable timing requirements.

Timing Requirements

The majority of the Act's provisions came into effect a few weeks ago on July 17, 2026; however, companies will have until January 1, 2027, to address the content requirements for new agreements involving the collection of agricultural data. 

Who is Covered?

The Act applies to any "controller" or "processor" that collects, stores, sells, or otherwise processes "agricultural data." Agricultural data means agronomic data, climate and weather data, land data, livestock data, management data, and sustainability data that is collected, produced, or generated in Nebraska and is linked, or reasonably linkable, to an identified or reasonably identifiable agricultural producer. “Agricultural producer” means the owner, lessee, or renter of a farm, parcel, livestock, land, device, or equipment from which agricultural data originates. Under the Act, the agricultural producer, not the controller or processor, is the owner of the resulting agricultural data.

Importantly, aggregated data, derived data (such as agronomic insights, reports, and predictive models), or data made available to the general public by a government agency are excluded from the definition of “agricultural data.”

Consent Required Before Sale

Because the agricultural producer, and not the controller or processor, owns the underlying agricultural data, a controller or processor may not engage in the sale of agricultural data without the agricultural producer's express written consent. That consent must be obtained through a clear and conspicuous disclosure that is separate from the primary terms of service or data use agreement, meaning it cannot be buried within broader contractual boilerplate.

The Act defines "sale" broadly as any exchange of agricultural data for monetary or other valuable consideration, but it carves out a number of common data flows, including disclosures to processors or affiliates, disclosures needed to provide a service to the producer, disclosures required by law or legal process, disclosures made in connection with a merger, acquisition, bankruptcy, or similar transaction, and disclosures reasonably necessary to detect or respond to fraud, cybersecurity threats, or equipment misuse.  In addition, as noted above, aggregated and the other categories of data listed above are carved out of these consent requirements.

Mandatory Contract Provisions

In addition to the consent requirements, beginning January 1, 2027, every new contract or agreement involving the collection or processing of agricultural data in Nebraska must include a specific provision stating that the controller or processor is prohibited from selling that data without the producer's express written consent. Any contract provision that waives or limits the Act's requirements is void and unenforceable as contrary to public policy. Businesses should build this requirement into contract templates and playbooks well before the operative date so that new agreements executed on or after January 1, 2027 are compliant from the outset.

Reasonable Security Safeguards

Separately from the consent and contracting obligations discussed above, and regardless of whether any sale of agricultural data occurs, any controller or processor in custody or possession of agricultural data must now establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of that data. These practices must be appropriate for the volume and nature of the agricultural data involved and must guard against unauthorized access, use, disclosure, modification, or loss.

Enforcement and Penalties

The Nebraska Attorney General has exclusive enforcement authority over the Act, and the Act does not create a new private right of action. The Attorney General may bring an action to seek injunctive relief or to recover a civil penalty of $1,000 for each separate violation. Violations of the mandatory contract-provision requirement (Sec. 6) and the reasonable-safeguards requirement (Sec. 7) are subject to a notice-and-cure process: the Attorney General must first provide written notice identifying the specific provision allegedly violated, and no civil penalty action may proceed if, within 45 days of that notice, the controller or processor cures the violation and provides the Attorney General a written statement confirming the cure and committing to no further violations. This notice-and-cure process does not apply to the consent-to-sale requirement (Sec. 5), which the Attorney General may pursue immediately.

Where Should Businesses Start?

Companies with a Nebraska agricultural data footprint should take the following steps:

• Map data flows to identify all agricultural data the business collects, stores, processes, or sells, and confirm whether that data originates from Nebraska farms, land, devices, or equipment.
• Confirm that a written, opt-in consent mechanism, presented separately from the general terms of service, is in place before any sale of agricultural data occurs.
• Assess existing data security practices against the Act's reasonable safeguards requirement, and document the administrative, technical, and physical controls the business has in place.
• Review and update data use agreements, vendor contracts, and customer-facing terms ahead of the January 1, 2027, deadline to include the required non-sale contract provision and confirm that such agreements do not contain provisions waiving or limiting producers’ rights with respect to agricultural data.
• Monitor other state laws for similar laws and/or limitations on the use of agricultural data.

Similar Active State Efforts

While Nebraska is the first state to enact an agricultural data privacy law, it is not the only state considering one. Other states, including Iowa and Missouri are actively pursuing similar producer-ownership and consent-based frameworks, and businesses operating in the agricultural space should monitor these developments alongside their Nebraska compliance efforts.