DPO SchoolDPO School

Nebraska Data Privacy Act

Nebraska privacy law (NDPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child (under 13), and precise geolocation within 1,750 feet. Controllers must obtain consent before processing sensitive data, and must follow COPPA for a known child. Every business, including small businesses, needs prior consent to sell sensitive data. There is no separate teen rule.

Key points

  1. Sensitive data: race or ethnicity, religion, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, known child data and precise geolocation.

    Section: § 87-1102(30)

  2. Consent required before processing sensitive data; for a known child, processing must follow COPPA.

    Section: § 87-1112(2)(d)

  3. A child is under 13; COPPA-compliant parental consent satisfies the Act.

    Section: § 87-1102(5); § 87-1106

  4. Small businesses outside the Act's main scope still need prior consent to sell sensitive data.

    Section: § 87-1118

  5. Consent excludes broad terms of use, hovering or closing content, and agreement obtained through dark patterns.

    Section: § 87-1102(6)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Nebraska statute

Reference material, not legal advice.