Nebraska Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What Nebraska’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.

What You Need to Know

Nebraska's law largely tracks the Texas Data Privacy and Security Act. Like Texas, applicability is not based on a consumer-count threshold – instead, it turns on whether an entity sells personal data and qualifies as a small business.

Official law text

Neb. Rev. Stat. §§ 87-1101 to 87-1130

Who the law applies to

Threshold	Requirement
Annual gross revenue	N/A
Consumers whose data is processed	N/A
Revenue from sale of personal data	N/A
Other conditions	Process or engage in the sale of personal data and not be a small business as defined by the U.S. Small Business Administration

Consumer rights under Nebraska's law15

Right	Provided?
Know	Yes
Access	Yes
Obtain list of third parties to which personal data was disclosed	No
Data portability note Right applies only to data provided by the consumer to the controller.	Partial
Delete	Yes
Correct inaccuracies	Yes
Not be discriminated against for exercising rights	Yes
Opt-out of sale	Yes
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling	Yes
Opt-out of ADMT	No
Recognize opt-out signals note Controllers must recognize UOOMs for state residents only if they are required to do so to comply with another state’s law.	Yes
Revoke consent	No
Not process data in discriminatory manner	No
Appeal	Yes

Tracking Nebraska’s privacy law? We write about it as the law changes.

Subscribe →

Categories treated as sensitive data8

Racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis
Sexual orientation
Citizenship or immigration status
Genetic or biometric data for purposes of uniquely identifying an individual
Personal data of known child
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.

How sensitive data must be treated2

Obtain Consent to Process
Conduct Data Protection or Risk Assessment

Requirements for minors' data1

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent

Activities that trigger a risk or impact assessment5

Targeted advertising (“sharing”)
Sale of personal data
Processing of sensitive data
Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
Any processing activities involving personal data that present a heightened risk of harm to consumers

Other notable provisions9

Definition of “Sale” Includes “Other Valuable Consideration”
Opt-out Request Can Be Verified
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Duty to Avoid Secondary Use
Data Minimization
Attorney General Enforcement
Right to Cure
note
30 day right to cure that does not sunset.

Key dates1

Date	What happens
January 1, 2025	Nebraska's consumer data privacy law takes effect

Questions about Nebraska’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Nebraska’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.