Nebraska
💡 Last Updated October 2025. Written with contributions from both human authors and LLMs. If you find incorrect or outdated information let us know at support@optery.com.
Nebraska's NDPA gives you the right to opt out of data brokers.
What the NDPA does for you
Nebraska's Data Privacy Act (NDPA) gives you meaningful control over your personal data. You have the right to know what data businesses collect about you, correct inaccuracies, delete your data, get a portable copy, and opt out of targeted advertising, data sales, and profiling. Businesses that are not small businesses and process or sell personal data must respect these rights. You can also appeal a business's denial of your request.
Your rights under the NDPA
Right to Know
You can ask a business to confirm whether it is processing your personal data and to give you access to that data.
Exceptions: Request must be authenticated; Controller may decline if request is manifestly unfounded, excessive, or repetitive (with ability to charge a fee); Does not apply to pseudonymous data where identifying information is kept separately with effective controls.
Source: Neb. Data Privacy Act § 7(2)(a) (LB 1074, Sec. 7)
Right to Delete
You can request that a business delete personal data it has collected or obtained about you.
Exceptions: Controller may retain a record of the deletion request and minimum data necessary to ensure data stays deleted; Does not apply to data necessary for legal compliance or other exempt purposes; Does not apply to pseudonymous data where identifying information is kept separately with effective controls; Request must be authenticated.
Source: Neb. Data Privacy Act § 7(2)(c) (LB 1074, Sec. 7)
Right to Correct
You can ask a business to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes for which it is processed.
Exceptions: Request must be authenticated; Does not apply to pseudonymous data where identifying information is kept separately with effective controls.
Source: Neb. Data Privacy Act § 7(2)(b) (LB 1074, Sec. 7)
Right to Opt Out of Sales
You can opt out of the sale of your personal data to third parties for monetary or other valuable consideration.
Exceptions: Does not apply to disclosure to a processor acting on the controller's behalf; Does not apply to disclosure to a third party to provide a product or service you requested; Does not apply to transfer of data to an affiliate of the controller; Does not apply to information you intentionally made public.
Source: Neb. Data Privacy Act § 7(2)(e)(ii) (LB 1074, Sec. 7)
Right to Opt Out of Processing
You can opt out of having your personal data processed for targeted advertising — that is, ads selected based on your activity across different websites or apps.
Exceptions: Does not apply to ads based on your activity within the controller's own websites or apps; Does not apply to ads based on the context of your current search or visit; Does not apply to ads shown in response to your own request for information.
Source: Neb. Data Privacy Act § 7(2)(e)(i) (LB 1074, Sec. 7)
Right to Opt Out of Automated Decisions
You can opt out of profiling when it is used to make decisions that have a legal or similarly significant effect on you, such as decisions about credit, housing, insurance, employment, education, criminal justice, or access to basic necessities.
Exceptions: Only applies to profiling in furtherance of decisions that produce a legal or similarly significant effect; Does not apply to all automated processing, only profiling for significant decisions.
Source: Neb. Data Privacy Act § 7(2)(e)(iii) (LB 1074, Sec. 7)
Right to Data Portability
You can request a copy of your personal data that you previously provided to a business in a portable, readily usable format so you can transfer it to another business, if the data is available in a digital format and the processing is done by automated means.
Exceptions: Only applies to data available in digital format and processed by automated means; Only applies to data you previously provided to the controller; Request must be authenticated.
Source: Neb. Data Privacy Act § 7(2)(d) (LB 1074, Sec. 7)
Right to Non-Discrimination
A business cannot discriminate against you for exercising your privacy rights, such as by denying a good or service, charging you a different price, or providing a lower quality of service.
Exceptions: A controller may offer different prices or service levels if you opt out of data sharing, as long as the offer is related to a bona fide loyalty or discount program; A controller is not required to offer a product or service that requires personal data it does not collect.
Source: Neb. Data Privacy Act § 12(2)(c) (LB 1074, Sec. 12)
Right to Limit Sensitive Data
Businesses must get your consent before processing your sensitive personal data, which includes data about race or ethnicity, religious beliefs, health diagnoses, sexual orientation, immigration status, genetic or biometric data, precise geolocation, and data about children.
Exceptions: Small businesses are prohibited from selling sensitive data without consent but are not subject to the full consent requirement for processing; Sensitive data of known children must be handled in compliance with COPPA.
Source: Neb. Data Privacy Act §§ 12(2)(d), 18 (LB 1074, Secs. 12, 18)
How to exercise your rights
- See which data brokers have your information. Optery scans 200+ brokers to show you what’s exposed. Start a free scan →
- Submit a NDPA deletion or opt-out request. Covered businesses have 45 days to respond (Neb. Data Privacy Act § 8 (LB 1074, Sec. 8)), with up to 45 additional days if they invoke the extension provision.
- Let Optery automate the whole process. We submit opt-out and deletion requests on your behalf, track compliance, and resubmit whenever brokers re-add your data. Sign up free →
Authorized agents
The NDPA does not mention authorized agents (Neb. Rev. Stat. § 87-1001 et seq.). This means data brokers are not required to honor privacy requests submitted by someone other than you personally. Optery can help you submit requests directly — we prepare everything for you; you hit send.
Enforcement and penalties
The NDPA is enforced by Nebraska Attorney General. If a business violates the Data Privacy Act and does not fix the problem within 30 days of being notified, it can be fined up to $7,500 per violation. The Attorney General can also seek injunctive relief and recover attorney's fees. All fines go to the State of Nebraska.
Who does the NDPA apply to?
The NDPA applies to businesses that conduct business in Nebraska or target products or services to Nebraska residents, process or sell personal data, and are not considered a small business under the federal Small Business Act. Many entities are excluded, including state agencies, nonprofits, institutions of higher education, financial institutions subject to Gramm-Leach-Bliley, HIPAA-covered entities, and certain utilities.
Frequently asked questions
Does the Nebraska Data Privacy Act apply to the company holding my data?
The law applies to businesses that conduct business in Nebraska or target their products or services to Nebraska residents, process or sell personal data, and are not a small business under the federal Small Business Act (Neb. Data Privacy Act § 3). Many entities are exempt, including nonprofits, state agencies, universities, financial institutions covered by Gramm-Leach-Bliley, and HIPAA-covered health entities. If the business is a small business by federal standards, most of the law does not apply — though even small businesses cannot sell sensitive data without your consent.
How long does a business have to respond to my data request?
A business must respond to your request within 45 days of receiving it (Neb. Data Privacy Act § 8(2)). If needed, they can extend the deadline by another 45 days, but only if they notify you within the first 45-day period and explain why the extension is necessary. Responses to your requests must be provided free of charge, up to twice per year.
What can I do if a business denies my privacy rights request?
If a business denies your request, it must tell you why within 45 days and provide instructions for how to appeal (Neb. Data Privacy Act § 8(3)). You can submit an appeal to the business and the business must respond in writing within 60 days (Neb. Data Privacy Act § 9(3)). If your appeal is also denied, the business must provide a way for you to contact the Nebraska Attorney General to submit a complaint.
Can someone else submit a privacy request on my behalf?
Yes, but in a limited way. You can designate an authorized agent to opt out of targeted advertising and the sale of your personal data on your behalf (Neb. Data Privacy Act § 11(5)). The business must honor the opt-out if it can verify both your identity as a Nebraska resident and the agent's authority to act for you. The law does not explicitly authorize authorized agents to submit deletion, access, or correction requests on your behalf.
What counts as 'sensitive data' under Nebraska's privacy law?
Sensitive data includes information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation, or citizenship and immigration status; genetic or biometric data used to uniquely identify you; personal data collected from a known child under 13; and precise geolocation data (within roughly 1,750 feet of your location) (Neb. Data Privacy Act § 2(30)). Businesses generally need your consent before processing this type of data.