Manage Privacy requirements of the Nebraska Data Privacy Act (NDPA)

The NDPA applies to organizations that conduct business in Nebraska or target Nebraska residents with products or services, and that process or sell personal data, provided they are not a small business as defined under the US Small Business Act (generally fewer than 500 employees).

There is no minimum revenue threshold or data-volume threshold. Small businesses are not fully exempt: they may not sell sensitive personal data without consumer consent.

Nebraska residents’ rights under the NDPA:

• Right to access: Consumers can request confirmation of whether a controller processes their personal data and obtain access to that data, subject to certain exceptions.
• Right to correction: Consumers can request that inaccurate or outdated personal data held by a controller be corrected.
• Right to delete: Consumers can request deletion of personal data a controller holds about them, with some exceptions.
• Right to data portability: Consumers can obtain a copy of personal data they previously provided to the controller in a readily usable format, subject to certain exceptions.
• Right to non-discrimination: Controllers may not penalize consumers for exercising their privacy rights, including by denying goods, services, or different pricing or quality levels.
• Right to opt out: Consumers can opt out of the sale of personal data, targeted advertising, or profiling used to make solely automated decisions that produce legal or similarly significant effects.

The NDPA generally follows an opt-out model for most personal data processing, meaning businesses can collect and process personal data without prior consent in most cases. However, explicit opt-in consent is required before processing sensitive personal data, including data belonging to children under 13.

Consent must be freely given, specific, informed, and unambiguous. The law specifically prohibits obtaining consent through dark patterns, acceptance of general terms of use, or passive actions such as hovering or closing content.

Controllers must respond to verified consumer requests within 45 days, with a possible 45-day extension when reasonably necessary. If an extension is needed, the controller must notify the consumer before the initial period ends.

If a request is denied, consumers must be informed of the reason and the appeal process. Controllers must respond to appeals within 60 days. If an appeal is denied, the controller must provide the consumer with an online mechanism to contact the Nebraska Attorney General to submit a complaint.

The Nebraska Attorney General can pursue civil penalties of up to USD 7,500 per violation. Before initiating enforcement action, the AG must provide written notice of an alleged violation and allow 30 days to cure.

If the violation is not remedied within that period — or if a corrective statement is found to be insufficient — enforcement can proceed. The NDPA does not provide a private right of action, meaning individual consumers cannot sue businesses directly for violations.

The NDPA requires businesses to honor universal opt-out signals — such as the Global Privacy Control (GPC) — indicating a user’s preference to opt out of targeted advertising or the sale of personal data. However, this obligation applies only if the business is already required to recognize such mechanisms under another state’s consumer privacy law. Learn more about Global Privacy Control and Universal Opt-Out Mechanisms.

The NDPA’s most notable distinction is its broad scope: unlike laws such as the CCPA or Virginia’s CDPA, it sets no minimum revenue or data-volume thresholds. It specifically prohibits consent obtained through dark patterns or passive user actions.