The Nebraska Data Privacy Act (NDPA) has applied since 1 January 2025 to businesses that operate in Nebraska or serve its residents and process or sell personal data, with no revenue or volume threshold. Small businesses under the federal Small Business Administration definition are exempt, except that they still need consent to sell sensitive data. The Nebraska Attorney General enforces the law, with a 30-day chance to cure and penalties of up to $7,500 per violation.
What the Nebraska Data Privacy Act covers
The legislature passed the NDPA in 2024 as Legislative Bill 1074, and it is codified at sections 87-1101 to 87-1130 of the Nebraska Revised Statutes. It took effect on 1 January 2025, and no later phase-in dates apply: every obligation, including the opt-out signal rule described below, has run from that day.
The NDPA closely mirrors the Texas Data Privacy and Security Act (TDPSA) in scope. Both laws stand out among US state privacy laws because they set no minimum revenue, employee count or data-processing volume. Instead, they exclude small businesses as defined by the US Small Business Administration (SBA).
This approach makes the NDPA unusual. Most other state privacy laws set volume thresholds. Virginia's VCDPA, for example, applies to businesses that process the data of 100,000 consumers, or of 25,000 consumers while deriving more than 50% of gross revenue from selling personal data. Nebraska skips these filters and asks a different question: is the business small by federal standards?
Who must comply and who is exempt
Under the Nebraska Attorney General's data privacy guidance and section 87-1103 of the Nebraska Revised Statutes, the law applies to a person that meets all three conditions:
- Conducts business in Nebraska or produces a product or service consumed by Nebraska residents
- Processes or sells personal data
- Is not a small business under the federal Small Business Act as it stood on 1 January 2024
The small business exemption has one exception. Under section 87-1118, a small business still may not sell sensitive data without the consumer's prior consent, and a violation carries the same penalty as any other.
The NDPA also exempts specific sectors and organisations:
- State agencies and political subdivisions
- Financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act (GLBA)
- Covered entities and business associates under HIPAA
- Nonprofit organisations
- Higher education institutions
- Electricity suppliers and natural gas utilities
Sections 87-1104 to 87-1106 exclude certain types of data and uses as well, so check them if you handle regulated data such as credit reports or employee records. If your organisation is not a small business, falls outside these exemptions and handles personal data from Nebraska residents, you are in scope.
Consumer rights under the NDPA
Nebraska residents receive a set of rights that align with the opt-out model seen in other US state laws. Consumers may:
- Confirm whether a controller is processing their personal data and access that data
- Correct inaccuracies in their personal data
- Delete personal data held by a controller
- Obtain a copy of their data in a portable format
- Opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects
Controllers must respond to consumer requests within 45 days. A single 45-day extension is available when reasonably necessary, but the controller must inform the consumer of the delay within the first 45 days. At least two secure and reliable methods for submitting requests must be provided, and a consumer cannot be made to create an account to use them.
If a request is denied, the consumer has the right to appeal. The controller must respond to the appeal within 60 days.
Sensitive data needs opt-in consent
The NDPA follows an opt-out model for most processing activities. Sensitive data is the major exception: it requires consent before processing.
Section 87-1102 defines sensitive data as:
- Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status
- Genetic or biometric data processed to uniquely identify an individual
- Personal data collected from a known child
- Precise geolocation data, meaning a location accurate to within 1,750 feet
For websites, this means any tracking pixel or analytics tag that processes sensitive categories, such as a location-based advertising script or a pixel on a health condition page, requires affirmative consent before firing. That overlaps with how cookie banners already handle opt-in categories under the GDPR.
Data protection assessments
Controllers must conduct data protection assessments for processing activities that present a heightened risk of harm. These include targeted advertising, the sale of personal data, processing of sensitive data, and risky profiling. An assessment completed for another state's law, such as the Connecticut CTDPA or Colorado CPA, can satisfy this requirement if it has a reasonably comparable scope and effect, which reduces duplicate work for multi-state operations.
Universal opt-out signals and the NDPA
The NDPA handles universal opt-out mechanisms such as Global Privacy Control (GPC) through its authorised agent rule. Section 87-1111 lets a consumer designate an authorised agent through technology, including an internet browser setting or extension, to opt out of targeted advertising and sales. A controller must comply with that signal, but the statute lists four situations where it does not have to, including when the controller does not process similar requests it receives under another state's laws.
In practice, that is why the NDPA's signal rule is described as conditional. If your website already honours GPC for California, Colorado, Connecticut, Montana or Texas, all of which require it, that exception no longer applies and you must honour the same signal for Nebraska consumers. The technology also has to reflect a real choice: it cannot use a default setting and must require an affirmative, freely given and unambiguous choice by the consumer.
For technical guidance on detecting the Sec-GPC header and integrating it with your consent management platform, see the GPC implementation guide.
How the NDPA compares with other US state privacy laws
The table below highlights where Nebraska's law sits relative to comparable frameworks.
| Feature | Nebraska (NDPA) | Texas (TDPSA) | Virginia (VCDPA) | Colorado (CPA) |
|---|---|---|---|---|
| Effective date | 1 Jan 2025 | 1 Jul 2024 | 1 Jan 2023 | 1 Jul 2023 |
| Applicability test | Not an SBA small business | Not an SBA small business | 100,000 consumers, or 25,000 plus sales revenue | 100,000 consumers, or 25,000 plus sales revenue |
| Sensitive data consent | Opt-in | Opt-in | Opt-in | Opt-in |
| Universal opt-out signal | Conditional | Required | Not required | Required |
| Cure period | 30 days (permanent) | 30 days | 30 days (permanent) | Expired 1 Jan 2025 |
| Private right of action | No | No | No | No |
Nebraska's permanent 30-day cure period is notable. Colorado, Montana, Delaware and Oregon have all ended theirs, while Nebraska gives businesses a standing right to fix violations before facing enforcement action.
Enforcement by the Attorney General
The Nebraska Attorney General holds exclusive enforcement authority over the NDPA. Section 87-1125 rules out a private right of action, so individual consumers cannot sue businesses directly.
Before bringing an action, the Attorney General must send a written notice at least 30 days in advance, identifying the provisions allegedly violated. Under section 87-1122, no action follows if the controller or processor cures the violation within those 30 days and gives the Attorney General a written statement that it has been cured, with supporting documents, and a written promise not to repeat it.
A violation after the cure period, or a broken written statement, can bring civil penalties of up to $7,500 per violation under section 87-1124, plus an injunction and the state's legal costs. These penalties accumulate per violation, so a systematic failure, such as ignoring opt-out requests across thousands of consumers, could produce significant liability. The Attorney General's Protect the Good Life portal also hosts the consumer complaint form.
Compared to enforcement trends elsewhere, the permanent cure provision makes Nebraska's regime relatively forgiving. A business that receives a notice and fixes the problem in time faces no penalty at all.
Practical steps for your website
If your website receives traffic from Nebraska, or you sell products or services to Nebraska residents, work through these steps.
1. Check whether you are a small business
Look up your industry's SBA size standard before anything else. If you fall under it, the NDPA applies to you only for the sale of sensitive data, which needs prior consent.
2. Audit your data processing activities
Run a cookie audit to identify every cookie and tracker on your site. Categorise each one as essential, functional, analytics or marketing. Pay particular attention to any processing that touches sensitive data categories.
3. Offer opt-out mechanisms
Provide clear opt-out options for targeted advertising and the sale of personal data. If you already honour GPC for another state, make sure your site recognises the Sec-GPC header for Nebraska visitors as well.
4. Obtain opt-in consent for sensitive data
If your site processes any of the sensitive categories listed above, collect affirmative consent before that processing begins. Your cookie banner should block sensitive-category scripts until the visitor explicitly agrees.
5. Update your privacy policy
Your privacy policy must disclose the categories of personal data processed, the purposes for processing, how consumers can exercise their rights, and whether data is sold or used for targeted advertising.
6. Establish request-handling workflows
Set up processes to handle access, correction, deletion and portability requests within the 45-day response window. Document your procedures for potential regulatory inquiries.
Nebraska privacy law in short answers
Does the Nebraska Data Privacy Act apply to small businesses?
Mostly not. The NDPA has no revenue or volume threshold, but it does not apply to small businesses as defined under the federal Small Business Act. The one exception: a small business still needs the consumer's prior consent before it sells sensitive data.
Do I need a cookie banner for Nebraska compliance?
The NDPA does not specifically mandate a cookie banner. However, you must provide opt-out mechanisms for targeted advertising and data sales, and obtain opt-in consent for sensitive data. A properly configured consent banner is the most practical way to meet these requirements.
Does the NDPA require recognition of Global Privacy Control?
Conditionally. A browser signal counts as an opt-out request through an authorised agent, and you must honour it unless an exception applies, such as not processing similar requests under another state's law. Since several states mandate GPC recognition, most websites with broad US traffic will need to honour it for Nebraska consumers.
What happens if my business violates the NDPA?
The Nebraska Attorney General must send a written notice at least 30 days before suing. If you cure the violation in that time and confirm it in writing, no action follows. If you do not, you face civil penalties of up to $7,500 per violation.
Can individual consumers sue under the NDPA?
No. The NDPA does not include a private right of action. Only the Nebraska Attorney General can enforce the law.
Is the 30-day cure period permanent under the NDPA?
Yes. Unlike several other state privacy laws that phase out their cure periods after a set date, Nebraska's 30-day cure provision has no end date.
Put Nebraska's opt-out rules into your banner
A law only shows up for visitors through your banner. Kukie.io scans your site, applies the consent model you choose for each region, treats a GPC signal as an opt-out where you use an opt-out model, and keeps a record of every choice.
