NDPA requirements
Nebraska's law took effect January 1, 2025 and follows the Texas model for scope: it applies to any business operating in Nebraska that processes or sells personal data and is not a small business under SBA standards, with small businesses still needing consent to sell sensitive data. Controllers must comply with universal opt-out mechanisms, subject to the statute's verification and capability exceptions, and obtain consent before processing sensitive data. The Attorney General enforces, with a permanent 30-day cure period and civil penalties of up to $7,500 per violation. Because the law has no consumer-volume threshold, companies that assumed they fell below the usual 100,000-consumer line are in scope here, and the tracking stack on a national website is the same in Omaha as it is in Austin.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.