Does Nebraska's Data Privacy Act Apply to Small Businesses?

Mostly no. The Nebraska Data Privacy Act (NDPA), in effect since January 1, 2025, exempts businesses that qualify as a "small business" under the U.S. Small Business Administration's size standards from most of its obligations — but that exemption has one significant carve-back: selling personal data still requires the consumer's consent, even for an exempt small business.

There's No Separate Numeric Threshold

Unlike most state privacy laws, which set their own revenue or consumer-count threshold (often 25,000 or 100,000 residents), the NDPA doesn't define its own number. It simply borrows the SBA's existing small business size standards, which already vary by industry and are typically expressed as either a revenue ceiling or an employee-count ceiling depending on the sector. That means Nebraska applies to any business that isn't a small business under those pre-existing federal standards — a broader reach than a law with its own high, law-specific threshold.

What "Not a Small Business" Actually Means in Practice

Because SBA thresholds are generally lower than the consumer-count or revenue thresholds other state privacy laws use, the NDPA's practical reach is wider: mid-size regional businesses that would clear a 25,000-consumer exemption in another state can still be caught by Nebraska's law if the SBA doesn't consider them small for their specific industry. Marketers running multi-state campaigns need to check Nebraska separately rather than assuming their largest-threshold state sets the floor everywhere.

The Consent Requirement That Survives the Exemption

Even a business that does qualify as an SBA small business isn't fully outside NDPA's scope. The law still requires that business to obtain a consumer's consent before selling that consumer's personal data to a third party, and the law's restrictions on processing sensitive personal data also continue to apply. In effect, the small business exemption removes most NDPA compliance burden — privacy notices, consumer rights requests, data protection assessments — but not the core consent gate on data sales.

Why This Still Matters for Lead-Gen and List-Based Marketing

Any Nebraska-facing business that sells or shares consumer data with list brokers, data co-ops, or third-party ad platforms as part of its monetization model needs an actual consent mechanism in place regardless of its size, since that specific obligation doesn't shrink with the exemption. A small business that skips data-sale consent because it assumes blanket exemption is misreading what the carve-out actually covers.

Enforcement Still Reaches Covered Businesses

The Nebraska Attorney General holds exclusive enforcement authority, with no private right of action for consumers to sue directly. Before bringing an action, the Attorney General must give notice and a 30-day cure period, and most legal guidance describes that cure period as permanent rather than set to expire on a fixed date. A business that doesn't fix the violation in time, or that breaks a written statement given to the Attorney General, faces a civil penalty of up to $7,500 per violation under the Nebraska Consumer Protection Act.

Bottom Line

Check whether you qualify as an SBA small business for your specific industry before assuming NDPA doesn't apply — and even if you do qualify, keep a working consent process for any sale of personal data, since that one obligation doesn't go away.

Sources: Mintz's November 2024 analysis of Nebraska's Consumer Privacy Act approaching its effective date, Benesch Law's summary of the NDPA's small-business exemption and its consent carve-back for data sales, and Koley Jessen's and Lewis Rice's guides to the NDPA's enforcement structure, cure period, and civil penalty cap.