Guide · US state law

NDPA: the Nebraska law with no volume threshold

The Nebraska Data Privacy Act has been in force since January 1, 2025 and uses no revenue or consumer-count thresholds. In this guide you will understand who must comply, the rule that reaches even small businesses, the opt-out through a browser setting and what changes for a site with AdSense or Ad Manager.

Audit my site for the US Read the guide

✓Based on bill LB 1074 and the Nebraska attorney general's website
✓Practical examples for sites with ads
✓Read-only scan, no changes to the site

30 daysto fix the violation after the attorney general's notice

$7,500maximum civil penalty per violation

45 daysto respond to requests, with an extension of another 45 days

60 daysto respond to an appeal from a consumer whose request was denied

What it is

A state law that swaps numbers for business size

The Nebraska Data Privacy Act, or NDPA, is Nebraska's general privacy law. It was passed in 2024 as bill LB 1074, sits in sections 87-1101 to 87-1130 of the state's laws and has applied since January 1, 2025.

The text follows the Texas model. Instead of counting consumers or looking at revenue, the law applies to anyone who does business in Nebraska or offers products and services consumed in the state, processes or sells personal data and is not a small business under the US federal definition.

Visitor rights are the same as in the most complete laws: access, correction, deletion, portability and refusal of targeted advertising, sale and automated profiling. Sensitive data requires consent.

For a site with visitors from the United States, this means the volume of Nebraska traffic is not the right question. The question is the size of the business. And even a small business needs consent to sell sensitive data.

Checklist

What you need to meet

If your company is not small under federal law and has visitors from Nebraska, this is the basic list.

Publish a complete privacy notice
The notice must be clear and easy to find. It lists the data processed, the purposes, how to exercise rights and appeal, the data shared and the categories of third parties.
Example
Privacy Policy link in the footer of every page, leading to the full notice.
Say there is targeted advertising and how to opt out
Anyone who sells data or does targeted advertising must say so clearly and visibly and explain how to opt out.
Example
Footer link: Do Not Sell or Share My Personal Information.
Ask for consent for sensitive data
Sensitive data only with consent. Even a small business needs consent before selling this data. A child's sensitive data follows COPPA.
Accept the opt-out sent by the browser
The visitor can opt out through an authorized agent, including a global device setting. Honor it when the request can be verified. The setting cannot be turned on by default.
Example
Visitor with GPC turned on: treat it as if they had clicked opt out.
Receive requests without requiring a new account
Offer two or more secure channels and do not require a new account. Respond within 45 days and answer the appeal in writing within 60 days.
Do the data protection assessment
Targeted advertising, sale of data and sensitive data require a recorded assessment. It is confidential, but the attorney general can request it.
7
Pass the opt-out to Google
Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. With GPP, Google reads the US National section for Nebraska.
Example
AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.
```
// Só para o visitante que recusou
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true,
});
```

In practice

Right and wrong

WrongOpt-out that only works after creating an account.
RightOpt-out link visible on every page, without asking for sign-up.
WrongThe site ignores the browser setting and keeps showing personalized ads.
RightThe browser sends GPC and the site treats it as an opt-out of sale and targeted advertising.
WrongThe site sells sensitive data without asking, thinking a small business is exempt.
RightThe site asks for consent before using or selling sensitive data.
WrongVague policy that does not say there is targeted advertising.
RightComplete policy, with the rights, the third parties and the appeal path.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag.

Who must comply

No revenue threshold and no minimum number of consumers

The law applies to anyone who meets the three conditions below, all at the same time. It does not matter how many Nebraska visitors the site gets.

Business tied to Nebraska

Does business in Nebraska or produces a product or service consumed by residents of the state. A site with a US audience usually fits here.

Processes or sells data

Processes personal data or takes part in the sale of that data. Cookies and ad identifiers count as personal data.

Not a small business

Not a small business under the US federal small business law, as of January 1, 2024. The criteria in that law vary by industry.

Small businesses have a rule too

Even a small business cannot sell sensitive data without the consumer's prior consent, and can be fined if it does.

Definitions

The words of the law, in plain site-owner language

The definitions are in section 2 of LB 1074 and follow the Texas and Virginia laws.

Personal data

Information linked, or reasonably linkable, to an identified or identifiable person, including sensitive data. On a site, this includes cookies, device identifiers, IP and email.

Sensitive data

Racial or ethnic origin, religious belief, health diagnosis, sexual orientation, immigration status, genetic or biometric data that identify the person, data of a known child and precise geolocation.

Sale

The exchange of personal data for money or other valuable consideration with a third party. Transfers to processors and to companies in the same group are left out.

Targeted advertising

An ad chosen using data about the visitor's activity on other companies' sites and apps. Ads based on the context of a search or the current visit do not count.

People's rights

What a Nebraska resident can ask for

The response must go out within 45 days, with an extension of another 45 if communicated within the initial period. An appeal against a denial must be decided within 60 days.

Confirm and access

Find out whether the company processes their data and get access to that data.

Fix

Ask for wrong data to be corrected.

Delete

Ask for personal data to be deleted.

Portability

Receive a copy of the data in a portable format.

Refuse targeted ads and sale

Ask that the data not be used for targeted advertising and not be sold, including through an authorized agent.

Refuse automated profiling

Refuse profiling that leads to decisions with legal or similarly significant effects.

Site obligations

What a covered business must have working

Privacy noticeThe notice must include the categories of data processed, the purposes, how to exercise rights and appeal, the categories of data shared with third parties and the categories of those third parties.
Disclose sale and targeted adsIf the site sells data or does targeted advertising, it must say so clearly and visibly and explain how the visitor can opt out.
Consent for sensitive dataSensitive data only with consent. For a small business, the rule applies to the sale of that data.
Data protection assessmentTargeted advertising, sale, risky profiling, sensitive data and other high-risk processing require a recorded assessment. It is confidential, but the attorney general can request it.
Accept the authorized agentThe consumer can designate an agent to refuse targeted ads and sale, including through a browser setting. The business must comply when it can verify the request with commercially reasonable effort.
Contracts with processorsVendors that process data on the business's behalf follow its instructions, under a contract with the rules of processing.

Enforcement and fines

Who enforces it and what a mistake costs

Only the Nebraska attorney general enforces the law. Consumers can complain through the attorney general's channels, but cannot sue the business under the NDPA.

30 days to cure

Before filing a case, the attorney general sends written notice and gives 30 days to fix the problem. The law sets no date for this period to end.

Written statement

To close the case, the business must fix the problem and send a written statement and documents proving the fix.

Up to $7,500 per violation

If the violation is not fixed in time, or if the business breaks the cure statement, the civil penalty can reach $7,500 per violation.

Complaint channels

The attorney general receives privacy complaints by online form, email, mail and phone.

Timeline

NDPA dates

Nebraska passed the law and gave a few months to prepare.

2024
Law passed
The Nebraska Legislature passes bill LB 1074, which creates the Data Privacy Act.
January 1, 2024
Reference for small business
The law uses the federal definition of small business as it existed on this date.
January 1, 2025
Entry into force
The law takes effect, with enforcement by the attorney general and a 30-day cure period.
September 2025
Google updates the GPP
Google starts accepting version 2 of the GPP US National section, the path it reads for opt-outs from states such as Nebraska.

Sites with AdSense and Ad Manager

Browser opt-out and the path to Google

Nebraska handles the universal signal in its own way. The consumer can designate an authorized agent to refuse targeted ads and sale using a technology, such as a link, a browser setting or extension, or a general device setting. The technology cannot be on by default and needs an active choice by the consumer.

The business must comply when it can verify the request with commercially reasonable effort. The law lists exceptions, for example when it is not possible to confirm that the consumer lives in Nebraska or when the business does not honor similar requests from other states. Since the Global Privacy Control, or GPC, is a signal of this kind, the safest path is to honor it for US traffic.

In AdSense and Ad Manager, under Privacy & messaging, Google offers a US state regulations message, and Nebraska is among the states covered. The visitor's opt-out turns on restricted data processing, called RDP. Google also says the partner can turn on RDP when it receives an opt-out GPC.

The GPP has a specific Nebraska section, but it is not on the list of sections Google accepts. For Google, the path is the US National section, or RDP directly in the tag, with the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense.

In practice

What is and is not allowed in Nebraska

Examples for a site with Nebraska visitors that monetizes with programmatic ads.

Allowed

Show contextual ads to people who opted out of targeted advertising
Apply the opt-out when the visitor's browser sends GPC
Use Google's state regulations message to offer the opt-out link
Take the opt-out to Google through the US National section of the GPP
Use data protection assessments made for other states, if they cover the same processing

Not allowed

Conclude you are outside the law just because you have little Nebraska traffic
Sell precise geolocation or other sensitive data without consent, even as a small business
Keep serving personalized ads after the visitor opted out
Leave the privacy page without explaining how to opt out of targeted advertising
Ignore the appeal of a consumer whose request was denied

Common errors

Where sites trip up with Nebraska's law

The lack of numbers in the law confuses people used to counting visitors by state.

Counting visitors instead of assessing size

The site has few Nebraska visitors and considers itself outside. But the law has no volume threshold: what matters is not being a small business.

Forgetting the sensitive data rule

The business is small, but uses a partner that buys visitors' precise geolocation. That sale requires consent.

Opt-out that does not reach the ads

The link exists, but requests to Google still go without RDP and without an opt-out in the GPP.

State section alone in the GPP

The CMP sends only the Nebraska section, which Google does not read. Without the US National section, Google does not receive the opt-out.

GPC handled only for California

The CMP applies the GPC only for California, and the signal sent by Nebraska visitors is ignored.

Generic policy

The privacy page does not mention data categories, third parties, sale, targeted advertising or how to appeal.

In ConsentMode

What the audit checks for Nebraska

Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
Turns on the GPC signal in the audit browser and compares the page and the ad requests with and without the signal.
Reads the GPP string and checks that the US National section exists and records the opt-out.
Identifies the CMP or Google's state regulations message from the page code.
Checks that the privacy page mentions data categories, third parties, sale, targeted advertising, rights and appeal.

Run an audit See everything that is checked

Frequently asked questions

How many Nebraska visitors do I need for the law to apply?

No minimum number. The law applies to anyone who does business in the state or has products consumed there, processes or sells personal data and is not a small business under the US federal definition.

My company is small. Am I off the hook?

Almost. A small business is outside most of the law, but cannot sell sensitive data without the consumer's prior consent. The small business criteria vary by industry, so it is worth confirming with a lawyer.

Does Nebraska require honoring the GPC?

The law lets the consumer use a browser setting as an agent to refuse targeted ads and sale, and the business must comply when it can verify the request. In practice, honoring the GPC is the safest path.

Will the 30-day cure period end?

The law sets no end date for this period, unlike states such as Minnesota and New Jersey.

Does Google read the Nebraska section in the GPP?

Google's list of accepted sections does not include Nebraska. Use the US National section, Google's state regulations message or RDP in the tag.

Does ConsentMode make my site compliant?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out, the GPC, the GPP and the privacy page, so you can fix it with your vendor and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether your site's opt-out works in Nebraska

The audit opens the site as a US visitor, with and without GPC, and shows what to fix, without changing anything.

Start the audit