• by Wendy Davis  @wendyndavis, April 12, 2024

Lawmakers in Nebraska have passed a privacy bill that would require companies to allow state residents to opt out of common forms of online ad targeting.

If enacted, the Data Privacy Act (LB 1074) would also obligate businesses to honor universal opt-out tools -- such as opt-out signals that consumers can send through their browsers -- but only if the companies honor those signals in other states.

The bill specifically gives people the right to opt out of "targeted advertising" -- defined in the measure as ads that are served to consumers based on their activity across sites and over time, and ads based on predictions about consumers' preferences or interests.

The definition excludes ads based on first-party data and current search queries or website visits.

The measure wouldn't give consumers the right to opt out of the processing of their data for measurement or reporting regarding ad performance, reach or frequency.

Other provisions would enable consumers to learn what non-pseudonymous data about them has been collected, and have that data deleted. The proposed law would also require companies to obtain consent before processing “sensitive” data -- including geolocation data, biometrics, and information revealing someone's race, religion, medical conditions, immigration status, sexual orientation.

Small businesses (as defined by the federal government) would be exempt from many provisions, but not from the mandate to obtain consent before processing sensitive data. 

Advocacy group Consumer Reports says the measure doesn't go far enough to protect privacy for several reasons, including that it allows companies to collect a broad swath of data on an opt-out basis.

“This bill does not include any sort of meaningful default restrictions on how companies collect or use personal data,” Consumer Reports policy analyst Matt Schwart stated Friday. “Instead, it burdens consumers with the responsibility of opting out to protect themselves.”

If Governor Jim Pillen approves the bill, the state will join more than a dozen others with comprehensive privacy laws.