iQ Cookie State Law Series
Cookie & Privacy Law in Nebraska
Educational purposes only — not legal advice. This guide is intended to help you understand Nebraska’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Nebraska’s NDPA took effect January 1, 2025, and it breaks from nearly every other state on this list in one specific way: there is no minimum consumer count or revenue figure that triggers coverage. Instead, the law applies broadly unless you qualify as a "small business" under federal Small Business Act standards — a fundamentally different test than the 25,000-to-100,000-consumer thresholds used elsewhere.
Nebraska does not have a separate cookie law. Cookie compliance flows from the NDPA itself — its opt-out and sensitive-data rules apply directly to cookies and tracking technology.
Who does it apply to?
The NDPA covers any business that conducts business in Nebraska, or produces products or services consumed by Nebraska residents, and processes or sells personal data — with no consumer-count or revenue floor to clear first.
Are you a "small business" under the federal Small Business Act (as of Jan 1, 2024)? If not, and you process or sell any personal data, you are likely in scope — regardless of how many Nebraska consumers that involves.
Even small businesses must get opt-in consent before selling sensitive data. Small-business status does not exempt you from that one rule.
Government agencies, GLBA-regulated financial institutions, HIPAA-covered entities, nonprofits, higher-education institutions, and energy utility providers are exempt outright.
Consumer rights
Nebraska residents whose data is covered by the NDPA can:
Businesses must respond within 45 days, extendable once by 45 more. There is no private right of action — only the Attorney General can enforce.
What makes Nebraska different
No threshold at all — the broadest applicability test in the series. Instead of a consumer count or revenue figure, coverage turns on whether you qualify as a federal "small business." A modest e-commerce site with a few hundred Nebraska customers could be in scope where it would be exempt in a threshold-based state.
"Consumed by" is broader than "targeted to." Nebraska’s applicability language covers products or services consumed by state residents, not just those actively marketed to them — a subtle but meaningful difference from peer-state statutory language.
The cure period never sunsets. While Colorado, Connecticut, and Delaware let their cure periods expire on a fixed date, Nebraska’s 30-day cure opportunity is written to continue indefinitely for future violations.
Cross-state assessment reuse is explicit. A data protection assessment completed to satisfy another state’s law can also satisfy Nebraska’s requirement, reducing duplicate paperwork for multi-state operators.
Small businesses still can’t sell sensitive data without consent. Even entities exempt from most of the NDPA must obtain opt-in consent before selling sensitive personal data — the one rule that reaches every business regardless of size.
Sensitive data & children
Processing sensitive data requires opt-in consent before any collection begins. Sensitive data includes:
Businesses that comply with COPPA’s verifiable parental consent requirements are deemed compliant with the NDPA’s parental consent obligations for known children’s data — a direct federal-standard alignment rather than a separate state test.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (health, biometric, geolocation) | Opt-in required | Gate these behind affirmative consent before they fire — applies even to small businesses. |
| Sale / targeted advertising cookies | Opt-out required | Provide a clear, accessible opt-out mechanism. |
| GPC / universal opt-out signals | Required since Jan 1, 2025 | Confirm your consent tool honors GPC automatically. |
| Profiling cookies (legal/significant effects) | Opt-out required | Offer an opt-out for profiling that materially affects consumers. |
| Any cookies — known children | COPPA-aligned consent | Verifiable parental consent satisfies NDPA obligations. |
Enforcement
The Nebraska Attorney General has exclusive enforcement authority. Before pursuing an enforcement action, the AG must provide 30 days’ written notice, giving businesses a real opportunity to fix the issue — and that opportunity does not expire the way it has in several peer states.
Your action checklist
Check your small-business status first, not your consumer count. If you don’t qualify as a federal small business and you process or sell any personal data, you are likely in scope regardless of size.
Confirm GPC recognition is live. Required since the law’s effective date of January 1, 2025.
Gate sensitive data behind consent even if you’re a small business. The opt-in-before-sale rule for sensitive data reaches every business, exempt or not.
Reuse existing data protection assessments. If you’ve already completed one for Colorado, Connecticut, or another peer state, check whether it satisfies Nebraska’s requirement too.
Build an internal appeal process. Consumers must be able to challenge a denied rights request through an accessible internal review.
Cover third-party-sourced data in deletion requests. Nebraska’s deletion right extends to data obtained from vendors and public records, not just what you collected directly.
Review vendor contracts. Any processor handling Nebraska resident data must be covered by a written agreement specifying processing instructions and confidentiality obligations.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner.
iQ Cookie State Law Series · Guide 14 of 25 · Next: New Hampshire →