The Nebraska Data Privacy Act: No Headcount Threshold, a Small-Business Sale Rule and a Documented Cure

LB 1074 and the Codified Range

The Data Privacy Act was enacted as part of Legislative Bill 1074 of the 108th Legislature, a broader banking and commerce bill. The slip law records approval by the governor on April 17, 2024, and its Section 1 provides that sections 1 to 30 "shall be known and may be cited as the Data Privacy Act." The remaining sections of the bill amend unrelated statutes such as the Public Entities Pooled Investment Act.

The thirty sections were codified as Neb. Rev. Stat. 87-1101 through 87-1130, which confirms the section range in this post's outline. Each codified page on the Legislature's site cites only Laws 2024, LB1074, with no later amendment. The Attorney General's Data Privacy Homepage states that the office took up this role "As of January 1, 2025."

Applicability Without a Consumer-Count Threshold

The heading holds against the text. Section 87-1103(1) applies the Act "only to a person" that meets three conditions:

1. Conducts business in Nebraska or "produces a product or service consumed by residents of this state";
2. "Processes or engages in the sale of personal data"; and
3. "Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section 87-1118 applies."

No consumer count, revenue share or dollar figure appears. Whether a business is small is answered by the federal Small Business Act as of a fixed date, not by a Nebraska number. That fixed-date drafting recurs throughout the Act: HIPAA, Gramm-Leach-Bliley, COPPA, FERPA, the Fair Credit Reporting Act and the FTC's catalog of dark patterns are each incorporated "as such act existed on January 1, 2024" or in similar words, so later federal changes do not flow in automatically.

Subsection (2) excludes state agencies and political subdivisions, financial institutions and Gramm-Leach-Bliley data, HIPAA covered entities and business associates, nonprofit organizations, and institutions of higher education. It also lists three utility categories found in few other statutes: electric suppliers under section 70-1001.01, natural gas public utilities under section 66-1802, and natural gas utilities owned by a city or a metropolitan utilities district. Section 87-1104 exempts seventeen categories of data, including HIPAA limited data sets.

The Small Business Rule for Sensitive Data

This heading also survives. Section 87-1118(1) provides that a person described by section 87-1103(1)(c), that is, a federally defined small business, "shall not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer." Subsection (2) makes a violator "subject to the penalty under section 87-1124." The rule reaches only sale. A small business processing sensitive data for its own purposes is outside the Act.

Three definitions in section 87-1102 give the rule its reach. A sale is an exchange "for monetary or other valuable consideration," broader than statutes that count only money. A known child is one whose age the controller has "actual knowledge of, or willfully disregards." Consent excludes acceptance of broad terms of use, "hovering over, muting, pausing, or closing" content, and agreement obtained through a dark pattern.

Consumer Rights and the Channels for Requests

Section 87-1107(2) grants access, correction, deletion of data "provided by or obtained about the consumer," a portable copy where data is digital and processing automated, and opt-outs of targeted advertising, sale, and profiling toward legally significant decisions. Profiling is defined narrowly as "solely automated processing." Section 87-1108 sets a 45-day response with one 45-day extension, two free responses a year, and a suppression-record option for third-party-sourced data.

Nebraska is more specific than most of its siblings about how requests arrive. Section 87-1111 requires "two or more secure and reliable methods," a request mechanism on the controller's website if it has one, and permits an email address alone only for a controller that "operates exclusively online" with a direct consumer relationship. Subsection (5) lets a consumer appoint an authorized agent for sale and advertising opt-outs "using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device." A controller may decline such a request if it is unclear, if Nebraska residency cannot be verified, if the controller cannot process it, or if the controller does not process similar requests under other states' laws. Subsection (6) bars default-on settings for these tools.

Two cross-references in the appeal provisions read unevenly. Section 87-1108(3) tells controllers to give instructions "on how to appeal the decision to the Attorney General in accordance with section 87-1109," yet section 87-1109 describes an appeal to the controller, decided within 60 days. Section 87-1109(4) then refers to "the online mechanism described in section 87-1108," which section 87-1108 does not describe; the complaint mechanism appears in section 87-1120, which directs the Attorney General to post one.

Data Protection Assessments

Section 87-1116 requires a documented assessment of targeted advertising, sale, risky profiling, sensitive data, and any processing presenting a heightened risk of harm, weighing benefits against risks and factoring in de-identified data, consumer expectations, context and the controller's relationship with the consumer. Assessments are confidential and exempt from Nebraska's public-records law. Unlike Kentucky and New Hampshire, the section contains no clause limiting the duty to processing begun after a stated date.

Section 87-1121(2) lets the Attorney General request a relevant assessment through a civil investigative demand and "evaluate the data protection assessment for compliance with sections 87-1112 to 87-1114," the sections on collection limits and consent, privacy notices, and sale and advertising disclosures.

Attorney General Enforcement and the Cure Period

Section 87-1119 gives the Attorney General exclusive enforcement authority, and section 87-1125 rules out a private right of action. Before suing, the office must give written notice at least 30 days ahead under section 87-1122. It may not sue if, within that time, the controller or processor cures and supplies "a written statement that the controller or processor cured the alleged violation and supportive documentation to show how such violation was cured," plus an express statement that the violation will not recur. The cure has no sunset in the codified text.

Section 87-1124 sets a civil penalty of up to $7,500 for each violation after a failed cure or a broken statement, authorizes injunctions, and allows recovery of attorney's fees and investigative expenses. Money collected goes to the State Treasurer for distribution under Article VII, section 5 of the Nebraska Constitution. Section 87-1120 requires the office to post controller, processor and consumer information and an online complaint mechanism; the Data Privacy Homepage links a complaint form.

No lawsuit, notice or settlement under sections 87-1101 to 87-1130 was located on the Attorney General's site as of October 26, 2026, so the enforcement record under the Act stands at zero. The office's October 14, 2026 complaint against OpenAI in Buffalo County mentions the Data Privacy Act in one factual paragraph but pleads its counts under the Consumer Protection Act, the Uniform Deceptive Trade Practices Act, common-law theories and the separate design code covered in the post on Nebraska's design code.

Frequently Asked Questions