Nevada Passes Online Consumer Privacy Legislation

June 17, 2019

States across the U.S. are rapidly passing new consumer privacy laws. In the first of this ongoing series of articles about these new laws and how they may affect you, we are looking at Nevada Senate Bill 220 which was signed May 29, 2019. It allows consumers to opt-out of the sale of their personal information by websites or online service operators. The new law will impact website operators and online service providers doing business in Nevada when it goes into effect October 1, 2019. 

Who must comply?

“Operators,” which is defined to include anyone who operates/owns a commercial website or online service and:

The following are not operators:

Who is protected?

“Consumers,” which are defined as persons who purchase or lease goods, services, money or credit for personal, family or household purposes from the Internet website or online service of an operator.1

What data is protected?

The law protects “covered information,” meaning any of the following items of personally identifiable information collected by an operator through an Internet website or online service and maintained in accessible form: a first and last name; a home or other physical address which includes the name of a street and the name of a city or town; an electronic mail address; a telephone number; a social security number; an identifier that allows a specific person to be contacted either physically or online; any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.

How to comply?

In order to comply, operators must:

Penalties for non-compliance

The law is enforceable by the Nevada Attorney General. Possible penalties include a temporary or permanent injunction or a civil penalty up to $5,000 per violation.

How does this compare to the California Consumer Privacy Act (CCPA)?

The new law is generally less restrictive than the CCPA because the definitions of “sale” and “covered information” are each much more narrowly defined and there is no private right of action.

What else do you need to know? 

Even before the passage of SB 220, Nevada law already required operators to post the following in their privacy notices:

Frost Brown Todd Summer Associate Nicole Barba contributed to this article.*   

*Not a licensed attorney

Nev.Rev.Stat.Ann. 603A.310