When does the GPC requirement take effect in Nebraska?

The universal opt-out mechanism requirement, including GPC recognition, takes effect on January 1, 2026.

What is Nebraska's Age-Appropriate Online Design Code (LB 504)?

LB 504, signed May 30, 2025, requires covered online services to implement privacy-by-design for users under 18, prohibits dark patterns, and mandates parental control tools. It applies to services with $25M+ gross revenue that are likely to be accessed by minors. The law took effect January 1, 2026, with AG enforcement beginning July 1, 2026. Penalties are up to $50,000 per violation.

Nebraska Privacy Law

Q: Does the NDPA have revenue or consumer count thresholds?

No. Like Texas, Nebraska did not establish specific thresholds, making the law broadly applicable to entities that conduct business in Nebraska and process personal data.

Q: What are the penalties under the NDPA?

Penalties are up to $7,500 per violation, enforced by the Nebraska Attorney General with a 30-day cure period.

Nebraska Data Privacy Act

Effective: January 1, 2025Active

Overview

The Nebraska Data Privacy Act (NDPA) was signed into law in 2024 and became effective on January 1, 2025. Nebraska took a unique approach by not establishing specific revenue or consumer count thresholds, making the law broadly applicable to entities that conduct business in Nebraska and process personal data, similar to the Texas approach. The NDPA provides Nebraska consumers with comprehensive privacy rights, including the right to access, correct, delete, and port personal data, as well as opt-out rights for data sales, targeted advertising, and profiling. The law includes an appeals process for denied consumer requests and requires businesses to honor universal opt-out mechanisms starting in 2026. Due to the absence of traditional applicability thresholds, the NDPA covers a broad range of businesses. The law includes a 30-day cure period and penalties of up to $7,500 per violation, enforced by the Nebraska Attorney General. The universal opt-out mechanism requirement will take effect on January 1, 2026.

Applicability Thresholds

Conditions are joined by OR — meeting ANY one triggers applicability.

No specific revenue or consumer count threshold. The law applies broadly to entities conducting business in Nebraska that process personal data.

Consumer Rights

Right to Access

Right to Delete

Right to Correct

Data Portability

Opt-Out of Sale

Opt-Out of Targeted Ads

Opt-Out of Profiling

Limit Sensitive Data Use

Right to Appeal

Private Right of Action

Key Changes in 2025-2026

Universal opt-out mechanism requirement takes effect January 1, 2026
Age-Appropriate Online Design Code Act (LB 504) effective January 1, 2026; AG enforcement begins July 1, 2026
LB 504 requires privacy-by-design for minors, prohibits dark patterns, mandates parental controls
Broad applicability (no thresholds) similar to Texas model
Continued enforcement and guidance from Nebraska AG

Enforcement Details

Enforced By

Nebraska Attorney General

Penalty Per Violation

$7,500

Cure Period

30 days

Private Right of Action

No — AG enforcement only

Sensitive Data Categories

Consent model: opt-in

Racial or ethnic originReligious beliefsMental or physical health diagnosisSexual orientationCitizenship or immigration statusBiometric data for identification

Universal Opt-Out / GPC Requirements

GPC / Universal Opt-Out Required

Starting January 1, 2026, businesses must recognize and honor universal opt-out mechanisms such as Global Privacy Control (GPC) for opt-out of data sales and targeted advertising.

Effective: January 1, 2026

Minor / Child Protections

The NDPA requires opt-in consent for processing personal data of known children under 13. Enhanced protections apply for teen consumers, requiring consent for targeted advertising and data sales. Additionally, Nebraska enacted the Age-Appropriate Online Design Code Act (LB 504) effective January 1, 2026, with AG enforcement beginning July 1, 2026. LB 504 requires covered online services to implement privacy-by-design for users under 18, prohibits dark patterns, and mandates parental control tools enabled by default for children under 13. Violations constitute deceptive trade practices with penalties up to $50,000 per violation.

Compliance Checklist

1Assess applicability — the NDPA has no specific thresholds, so most businesses processing Nebraska consumer data are covered
2Prepare to implement universal opt-out signal recognition by January 1, 2026
3Assess if your online service is subject to the Age-Appropriate Design Code (LB 504) — applies to services likely accessed by minors with $25M+ revenue
4If covered by LB 504, implement privacy-by-design for users under 18 and enable parental control tools by default for children under 13
5Update privacy notices with all NDPA-required disclosures
6Implement consumer rights request mechanisms with 45-day response period
7Obtain opt-in consent for processing sensitive personal data
8Establish an appeals process for denied consumer rights requests

Nebraska Privacy Law FAQ

Official Resources

Disclaimer: PrivacyLawMap provides general information about US state privacy laws for educational purposes only. This is NOT legal advice. Privacy laws are complex and frequently amended. Consult with a qualified privacy attorney for advice specific to your business. PrivacyLawMap makes no warranties about the accuracy or completeness of this information.