Regulations › US states › Nebraska
NDPA
Nebraska Data Privacy Act
WhenIn effect since 1 January 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsNo numeric threshold
Universal opt-outAuthorized agents, including browser or device settings, may opt out
Cure periodPermanent 30-day cure period after written AG notice
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation plus investigative costs and attorney fees
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
3
No numeric threshold; any business processing or selling personal data except federal SBA small businesses, which still need consent to sell sensitive data.LB 1074 §§ 3(1), 18 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, higher education and certain utilities.LB 1074 §§ 3(2), 4 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Sensitive data and minors
Sensitive data
1
Opt-in consent required to process sensitive data; known child data processed per COPPA.LB 1074 § 12(2)(d) · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Children and teens
1
Child means under 13; COPPA-compliant parental consent satisfies the Act. No teen protections.LB 1074 §§ 2, 6, 7(1) · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Data minimization
1
Collection limited to what is reasonably necessary for disclosed purposes.LB 1074 § 12(1) · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Consumers' rights
Rights
2
Access, correct, delete, portability, opt out of targeted ads, sale and significant profiling (7 rights).LB 1074 § 7 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Request deadline
2
45 days, extendable once by 45 days with notice.LB 1074 § 8 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Appeals
2
Internal appeal decided within 60 days; denial must give way to complain to the Attorney General.LB 1074 §§ 8(3), 9 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Universal opt-out
1
Authorized agents, including browser or device settings, may opt out; controllers honor them if they can verify identity and authority.LB 1074 § 11(5)-(6) · source ↗
Text does not clearly mandate universal signal recognition; DWT tracker lists no UOOM requirement. Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Business duties
Assessments
2
Required for targeted ads, sale, risky profiling, sensitive data and heightened-risk processing; available to the AG.LB 1074 § 16 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Processor contracts
2
Detailed contract terms, confidentiality, deletion, compliance information, assessments or independent audit report, written subcontractor flow-down.LB 1074 § 15 · source ↗
No controller objection right for subcontractors found. Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Privacy notice
1
Notice of categories, purposes, rights, third-party sharing; clear sale and targeted ads disclosure with opt-out method.LB 1074 §§ 13-14 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Loyalty programs
1
Bona fide loyalty and rewards programs carved out of non-discrimination rule.LB 1074 § 12(3) · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
De-identified data
3
Public no-reidentification commitment, contract duties for recipients, and pseudonymous data exemptions with separation.LB 1074 §§ 2, 17 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority, including civil investigative demands.LB 1074 §§ 19, 21, 23 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Cure period
0
Permanent 30-day cure period after written AG notice.LB 1074 § 22 · source ↗
DWT tracker also lists no expiration. Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Maximum penalty
2
Up to $7,500 per violation plus investigative costs and attorney fees.LB 1074 § 24 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Private action
0
No private right of action.LB 1074 § 25 · source ↗
Cited by LB 1074 bill section; codified at Neb. Rev. Stat. §§ 87-1101 to 87-1130, exact section mapping not verified.
Rulemaking
0
No rulemaking authority found.LB 1074 (no provision found) · source ↗
Read text was truncated after § 30; rulemaking absence also consistent with DWT tracker.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws