Privacy
Nebraska Data Privacy Act
The act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, processes or sells personal data, and is not a small business as determined under the federal Small Business Act. A small business is still barred from selling a consumer's sensitive data without prior consent (Section 87-1118). It does not apply to state agencies, Gramm-Leach-Bliley financial institutions, HIPAA covered entities, nonprofit organizations, institutions of higher education, and certain utilities. The Governor approved LB1074 on April 17, 2024, and its privacy sections became operative on January 1, 2025.
What the website needs
- A controller must provide a reasonably accessible and clear privacy notice listing the categories of personal data processed (including sensitive data), the purpose of processing, how to exercise rights and appeal, the categories of data shared with third parties and the categories of those third parties, and the methods for submitting requests (Section 87-1113).
- A controller that sells personal data or processes it for targeted advertising must clearly and conspicuously disclose that processing and how to opt out (Section 87-1114).
- A controller must offer two or more secure methods for rights requests and must provide a request mechanism on its website if it maintains one; an exclusively online controller with a direct consumer relationship only has to provide an email address (Section 87-1111).
- A controller must obtain consent before processing sensitive data (Section 87-1112).
