Nebraska Data Privacy Act (NDPA) Reference Guide

The NDPA applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, processes or sells personal data, and is not a small business under the federal Small Business Act as it existed January 1, 2024. Neb. Rev. Stat. § 87-1103

The act lists entity and data exemptions, including state agencies, regulated financial institutions and data, HIPAA covered entities and business associates, nonprofits, higher education, specified utilities, employment-context data and several federally regulated datasets. Nebraska Legislature: full act

A person excluded because it is a qualifying small business still may not sell sensitive personal data without prior consumer consent. Neb. Rev. Stat. § 87-1118

Nebraska consumers may confirm processing and access data, correct inaccuracies, delete personal data, obtain eligible data in portable form, and opt out of targeted advertising, personal-data sales and qualifying profiling. Neb. Rev. Stat. § 87-1107

Controllers generally must respond within 45 days, with one justified 45-day extension. Appeals must be decided in writing within 60 days. Neb. Rev. Stat. §§ 87-1108–87-1109

Nebraska defines sale as an exchange of personal data for monetary or other valuable consideration, subject to listed exclusions. Targeted advertising concerns ads selected using activity over time and across nonaffiliated sites or apps. Neb. Rev. Stat. § 87-1102

A controller that sells personal data or processes it for targeted advertising must conspicuously disclose the process and explain how a consumer may opt out. Neb. Rev. Stat. § 87-1114

A consumer may designate an authorized agent through technology including a website link, browser setting or extension, or global device setting to communicate opt-outs for targeted advertising and sale. A controller must comply when it can verify the consumer and the agent’s authority with commercially reasonable effort, subject to statutory conditions. Neb. Rev. Stat. § 87-1111(5)

The statute permits noncompliance where, among other conditions, the request is unclear, residency cannot reasonably be verified, the controller lacks the ability to process it, or the controller does not process similar requests for other state laws. The technology also must require an affirmative choice and be consumer-friendly. Neb. Rev. Stat. § 87-1111(5)–(6)

The Nebraska Attorney General has exclusive enforcement authority. Before bringing an action, the Attorney General must give written notice identifying the alleged violations at least 30 days in advance. An action may not proceed when the controller or processor cures within that period and provides supporting documentation plus an express written nonrecurrence statement. Neb. Rev. Stat. §§ 87-1119 and 87-1122

After the cure process, or if a written statement is breached, civil penalties may reach $7,500 per violation. The NDPA creates no private right of action. Neb. Rev. Stat. § 87-1124 Neb. Rev. Stat. § 87-1125

Counsel determines Small Business Act status, exemptions, sale, targeted advertising, profiling and sensitive-data treatment. Product and engineering teams implement those decisions across consent tools, hard-coded scripts, tag managers, APIs and downstream platforms.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Qualified privacy counsel should address federal small-business status, exemptions, classifications, notices, contracts, rights requests, assessments, sensitive data and governance.

This guide relies on the current Nebraska Revised Statutes and the official enrolled slip law for LB1074. The slip law confirms that Data Privacy Act sections 1 through 30 became operative January 1, 2025.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, contracts, assessments and governance.