79%
of Nebraska's 19 requirements are already met by California (CA). Here is what NDPA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
NDPA adds3 No numeric threshold; any business processing or selling personal data except federal SBA small businesses, which still need consent to sell sensitive data.
LB 1074 §§ 3(1), 18 · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
NDPA adds2 Internal appeal decided within 60 days; denial must give way to complain to the Attorney General.
LB 1074 §§ 8(3), 9 · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
NDPA adds1 Opt-in consent required to process sensitive data; known child data processed per COPPA.
LB 1074 § 12(2)(d) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
NDPA adds3 Public no-reidentification commitment, contract duties for recipients, and pseudonymous data exemptions with separation.
LB 1074 §§ 2, 17 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means NDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
