Nebraska Privacy Law (NDPA): Compliance Guide
The Nebraska Data Privacy Act (LB 1074), effective January 1, 2025, quietly became the broadest state privacy law in America by having no consumer-volume thresholds at all. If you do business in Nebraska — or your products or services are consumed by Nebraskans — and you process or sell personal data, you are covered unless you qualify as an SBA-defined small business. Even then, selling sensitive data without consent is off-limits. GPC has been mandatory since day one.
- Effective
- January 1, 2025
- GPC / universal opt-out
- Required since January 1, 2025
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Nebraska Data Privacy Act (LB 1074)
Applicability
Who must comply with the NDPA
The Nebraska Data Privacy Act applies to businesses that meet the following criteria:
- Conducts business in Nebraska or produces products or services consumed by Nebraska residents, and
- Processes or sells personal data, and
- Is not a “small business” under SBA definitions — with one exception: even small businesses may not sell sensitive data without consent
- No consumer-volume thresholds — broader applicability than any other state
Consumer rights
What Nebraska consumers can demand
- Right to access personal data
- Right to correct inaccuracies
- Right to delete personal data
- Right to data portability
- Right to opt out of the sale of personal data, targeted advertising, and profiling
Opt-out mechanics
Nebraska opt-out & GPC requirements
Like every US state privacy law, the NDPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Nebraska is “Your Privacy Choices”.
Global Privacy Control: Required since January 1, 2025
Nebraska requires covered businesses to honor universal opt-out mechanisms such as Global Privacy Control. The requirement has been in force since January 1, 2025 — the law's first day.
Enforcement
NDPA penalties & enforcement
- Up to $7,500 per violation
Cure period: 30-day cure period.
State quirks
What makes Nebraska different
Every other state gates its law behind consumer counts or revenue figures; Nebraska does not. The only gate is the SBA small-business definition — and that carve-out still bars selling sensitive data without consent. That makes the NDPA the one state law a small US business genuinely cannot ignore. The rest of the framework is standard: five consumer rights, $7,500 maximum per violation, a 30-day cure period, and universal opt-out signal honoring required since January 1, 2025.
No volume thresholds
The broadest applicability of any state law: coverage turns on doing business in Nebraska and processing or selling personal data — not on hitting consumer-count or revenue numbers.
Small business carve-out with a catch
SBA-defined small businesses are generally exempt, but even they may not sell sensitive data without consent.
Automation
How ConsentKit handles Nebraska
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Nebraska visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Nebraska visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Because Nebraska requires universal opt-out signals, ConsentKit automatically honors Global Privacy Control for Nebraska visitors: when the browser broadcasts GPC, the widget applies the opt-out and denies analytics and marketing categories with no click required.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Nebraska visitor makes a choice.
With no volume thresholds, nearly every Nebraska-facing business is covered — ConsentKit's one-line install gets the opt-out link and GPC honoring live in minutes.
FAQ
Nebraska NDPA FAQ
Does Nebraska's NDPA really have no volume thresholds?
Correct — the broadest applicability of any state law. It covers any business that operates in Nebraska or whose products or services are consumed by Nebraska residents, processes or sells personal data, and is not a small business under SBA definitions. Even SBA small businesses are barred from selling sensitive data without consent.
Is Global Privacy Control required in Nebraska?
Yes — from the law's first day, January 1, 2025. Covered businesses must honor universal opt-out mechanisms such as Global Privacy Control for Nebraska visitors.
What are the penalties under the NDPA?
Up to $7,500 per violation, with a 30-day cure period to fix a noticed violation before penalties are assessed.
What rights do Nebraska consumers have?
Nebraska consumers can access, correct, delete, and obtain a portable copy of their personal data, and can opt out of the sale of personal data, targeted advertising, and profiling.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the NDPA.
Comply with Nebraska's NDPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.