The Nebraska Data Privacy Act copied the Texas approach: instead of consumer-count thresholds, it applies to any business operating in Nebraska or serving Nebraska residents that processes or sells personal data and is not a federally defined small business. Even exempt small businesses need consumer consent before selling sensitive data.
What the Nebraska Data Privacy Act Requires
Covered businesses must post a privacy notice, honor access, correction, deletion, and portability requests, obtain consent for sensitive data, offer opt-outs from targeted advertising, sale, and significant profiling, and avoid dark patterns in consent flows. Universal opt-out signals must be honored.
Enforcement and Penalties
The Attorney General enforces exclusively, with a permanent 30-day cure period and civil penalties up to $7,500 per violation. Because coverage turns on small business status rather than data volume, many mid-sized companies that escape other state privacy laws are covered here and should not assume Nebraska works like the threshold states.
Source: Nebraska Legislature: LB 1074, Neb. Rev. Stat. 87-1101 et seq.
Report a violation: If you believe a business is violating this law, you can file a complaint with the Nebraska Attorney General Consumer Protection Division.
