Key Facts
Overview
Nebraska's NDPA has no revenue or data volume thresholds, making it applicable to businesses of all sizes (similar to Texas). It uniquely defines precise geolocation data as within a 1,750-foot (533.4m) radius and requires honoring GPC/UOOM signals.
What This Means for Your Website
- GPC/UOOM signals must be honored
- Opt-in consent required for sensitive data, including precise geolocation (defined as within 1,750 feet)
- No revenue or data volume thresholds, so nearly all businesses must comply
- SBA-defined small businesses are exempt from general obligations but cannot sell sensitive data
- A permanent 30-day cure period applies
Key Requirements
The Nebraska AG enforces the NDPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days. The absence of thresholds means the law captures far more businesses than most states. The unique 1,750-foot geolocation definition creates a specific standard for precision.
How ConsentStack Handles This
ConsentStack detects Nebraska visitors, honors GPC signals, and applies opt-in consent for sensitive data categories using Nebraska's specific geolocation definition.
Penalties
Up to $7,500 per violation.
Key Requirements
- Honor GPC/universal opt-out signals
- Opt-in consent for sensitive data including precise geolocation
- Consumer rights: access, correct, delete, portability, opt-out
- 45-day response window for consumer requests
- Data protection assessments for high-risk processing
Notable Provisions
- No revenue or data volume thresholds, similar to Texas
- Precise geolocation = within 1,750-foot radius, a unique definition
- Small businesses exempt but cannot sell sensitive data
- Must honor GPC/UOOM signals
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data; a parent or legal guardian may exercise this right for a known child.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you.
Where the data is digital and processed by automated means, obtain a copy of the personal data you previously provided in a portable and, where technically feasible, readily usable format you can transmit to another controller.
Opt out of the processing of your personal data for targeted advertising.
Opt out of the sale of your personal data.
Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, such as the provision or denial of financial and lending services.
Appeal a controller's refusal to act on your request through a process that must be conspicuously available and similar to the request process, and receive a written explanation of the decision.
If a controller denies your appeal, it must give you the Attorney General's online mechanism for submitting a complaint under the Act.
Designate an authorized agent, including through a link, browser setting or extension, or global device setting, to opt out of targeted advertising or the sale of your personal data for you; this agent right does not extend to profiling or other requests.
A controller may not discriminate against you for exercising your rights, including by denying a good or service, charging a different price or rate, or providing a different level of quality, though bona fide loyalty programs remain allowed.
US State Specifics
Other North America Regulations
Frequently Asked Questions
NDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with NDPA
ConsentStack helps you implement Opt-out consent for Nebraska, United States automatically.