Nebraska

Nebraska Data Privacy Act

Nebraska’s consumer privacy law. It gives Nebraska residents rights over their personal data and sets rules for businesses that meet its size limits.

Status
In effect since January 1, 2025
Citation
Neb. Rev. Stat. § 87-1101 et seq.
Official text
Read the law(opens in a new tab)

Who it covers

Any business that isn’t a “small business” under U.S. SBA size standards. Small businesses still need consent before selling sensitive data.

What it asks of your website

  • A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
  • Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
  • Accept opt-outs sent through a browser setting or extension acting as the consumer’s authorized agent.
  • Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
  • Offer an appeal when you turn down a privacy request.

Who has to comply: no size threshold

The Nebraska Data Privacy Act took effect on January 1, 2025. Like Texas, it has no revenue or volume threshold. It covers any business that operates in Nebraska or makes products or services Nebraskans use, unless it’s a small business under U.S. SBA standards.

Small businesses aren’t fully off the hook: they may not sell sensitive data without the consumer’s prior consent. Nonprofits, government bodies, colleges, financial institutions and HIPAA covered entities are exempt.

Visitors’ rights and your deadlines

  • Rights to access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling.
  • Offer two or more secure ways to make requests, including one on your website if you have one.
  • Respond within 45 days, extendable once by 45 more with notice. Free up to twice a year.
  • Appeals: answer within 60 days; a denial must say how to complain to the Attorney General.

Opt-out signals

Nebraska treats a browser setting or extension as a way for a consumer to name an authorized agent to opt out for them. The technology can’t use a default setting; it must reflect the consumer’s own clear choice. The statute doesn’t name Global Privacy Control, and the Attorney General hasn’t published guidance on it, so honoring GPC is the cautious course.

Sensitive data and children

Sensitive data needs consent. It includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic and biometric data, data of a known child under 13, and precise geolocation. Children’s data must be handled under COPPA.

A separate law, the Age-Appropriate Online Design Code Act, has applied to online services and minors under 18 since January 1, 2026, with its own thresholds.

Enforcement

The Attorney General has exclusive authority; there’s no private right of action. Before acting, the Attorney General must give notice and 30 days to cure, with no end date in the statute; to use it you must cure, confirm in writing and promise not to repeat. Penalties are up to $7,500 per violation, plus injunctions and attorney fees. The Attorney General runs an online complaint portal for the law.

Where GoConsent helps

Privacy Policy builder

A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.

Opt-outs and requests

Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.

Copy and delete requests (Pro)

Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.

Children’s Privacy Policy (Pro)

A children’s privacy notice page for sites that may collect information from children under 13.

A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.

FAQ

Questions, answered

Does Nebraska’s privacy law have a size threshold?

No. It covers every business except small businesses under SBA standards.

Do small businesses have any duties in Nebraska?

Yes. They need prior consent before selling sensitive data.

Is there a cure period in Nebraska?

Yes, 30 days, with no end date in the statute.

Sources

Check your site against this law

GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.

Get GoConsent free See Pro plans