Nebraska Data Privacy Act (NDPA)
A practical compliance guide for website owners. Learn what Nebraska's privacy law requires and how to implement it on your site.
Who Must Comply
Conducts business in Nebraska or targets Nebraska residents AND is not a small business as defined by the SBA (applies regardless of consumer volume thresholds)
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Required |
| Honor GPC browser signals | Required |
| Universal opt-out mechanism | Required |
| Sensitive data opt-in consent | Required |
Checked against the NDPA on August 29, 2026. Read the source This is a summary, not legal advice.
Required Links & Notices
The NDPA requires the following links or notices to be visible on your website:
- 1Privacy Policy
Enforcement & Penalties
Key Things to Know
The Nebraska Data Privacy Act (NDPA) has applied in Nebraska since January 1, 2025.
Who it covers: Conducts business in Nebraska or targets Nebraska residents AND is not a small business as defined by the SBA (applies regardless of consumer volume thresholds).
Do Not Sell and opt-out rights: residents may opt out of the sale of their personal data and opt out of targeted advertising. The choice has to be available without making the consumer hunt for it, and you may not degrade the service of someone who exercises it.
Global Privacy Control: NDPA requires you to honour a universal opt-out mechanism sent by the visitor’s browser. A GPC signal has to be treated as the opt-out itself — not as a request to show someone a banner — and it applies to that browser without any further action from the person.
Cookie banner: NDPA is an opt-out law, so it does not require the opt-in banner the GDPR does. What it does require is that the tracking you run for advertising can be switched off on request, which in practice means a preference control that actually blocks tags rather than a notice that only records a click. Sensitive data is the exception: that needs consent before you process it.
Enforcement: $7,500 per violation. 30-day cure period (sunset January 2026). Enforced by the Nebraska Attorney General.
How to Configure LegalBanner for NDPA
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Nebraska's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a NDPA-compliant privacy policy.
Set up NDPA compliance in 5 minutes
LegalBanner handles Nebraska privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
Why is Nebraska's privacy law unique?
Nebraska is the only state with no consumer volume threshold. It applies to all non-small businesses operating in Nebraska or targeting Nebraska residents, regardless of how many consumers' data they process.
What defines a 'small business' exemption?
Nebraska uses the SBA (Small Business Administration) definition, which varies by industry based on annual revenue or number of employees. Generally, this covers businesses with fewer than 500 employees or under specific revenue thresholds.
Does Nebraska require a cookie consent banner?
No. Nebraska does not require opt-in cookie consent. You must provide opt-out mechanisms for targeted advertising and sale of personal data.
Does Nebraska require honoring GPC signals?
No. Nebraska does not require honoring GPC or universal opt-out mechanisms.
What are the penalties for NDPA violations?
Up to $7,500 per violation. The 30-day cure period sunsets in January 2026.