U.S. Nevada SB220 — Internet Consumer Privacy Law

Why does it matter?

SB 220 is a single-right statute, which is why it is easy to overlook and easy to get wrong. Any business whose website or app collects a Nevada resident's name, email address or phone number and sells that information for money owes that resident a designated request address, a way to verify the request and a response within 60 days (NRS 603A.345). The Attorney General can seek up to $5,000 per violation, and since SB 260 (2021) the same duties bind data brokers that never deal with the consumer directly (NRS 603A.346 and 603A.360). A first failure can be cured within 30 days of being informed of it; a second cannot (NRS 603A.347 to 603A.350).

Key benefits include:

• One right, precisely defined

The statute confers a single consumer right: a verified request directing an operator or data broker not to make any sale of covered information it has collected or will collect about the consumer (NRS 603A.345(2) and 603A.346(2)).

• A fixed response clock

An operator or data broker responds within 60 days of receipt and may extend once by no more than 30 days if reasonably necessary, notifying the consumer of the extension (NRS 603A.345(4) and 603A.346(4)).

• A narrow definition of sale

Sale means the exchange of covered information for monetary consideration to another person; disclosures to processors, to a person with whom the consumer has a direct relationship, for purposes consistent with the consumer's reasonable expectations, to affiliates and in mergers are excluded (NRS 603A.333).

• Notice contents fixed by statute

NRS 603A.340 lists what the privacy notice must contain, from the categories of covered information and third parties to the notice's effective date, with a small-operator exemption.

• A first failure can be cured

An operator or data broker that has not previously failed to comply may remedy a notice or request failure within 30 days after being informed of it and does not violate the section for enforcement purposes (NRS 603A.347 to 603A.349).

How does it work?

NRS 603A.310 to 603A.338 set the definitions and scope. A consumer is a person who seeks or acquires goods, services, money or credit for personal, family or household purposes from an operator's website or online service. An operator owns or operates a commercial Internet website or online service, collects and maintains covered information from Nevada residents who use or visit it, and purposefully directs activities toward Nevada, transacts with the state or a resident, or otherwise has sufficient nexus; third-party hosts and processors, HIPAA entities, motor vehicle manufacturers and repairers handling vehicle data, and persons who do not collect, maintain or sell covered information are excluded (NRS 603A.330). A data broker's primary business is purchasing covered information about Nevada consumers with whom it has no direct relationship from operators or other data brokers and selling it (NRS 603A.323). NRS 603A.338 removes consumer reporting agencies, FCRA, fraud-prevention, public, DPPA and GLBA data, and consumer health data from the sections entirely.

NRS 603A.340 requires an operator to make available, in a manner reasonably calculated to be accessible to the consumers whose covered information it collects, a notice that identifies the categories of covered information collected and the categories of third parties with whom it may be shared, describes the process, if one exists, for a consumer to review and request changes to that information, describes how consumers are notified of material changes, discloses whether a third party may collect covered information about a consumer's online activities over time and across sites, and states its effective date. An operator located in Nevada whose revenue comes primarily from sources other than online sales and whose site has fewer than 20,000 unique visitors a year is exempt (603A.340(2)). NRS 603A.345 adds the designated request address, an email address, toll-free number or website through which a consumer submits a verified request, one the operator can reasonably verify as authentic using commercially reasonable means (NRS 603A.325 and 603A.337).

Once an operator receives a verified request it shall not make any sale of any covered information it has collected or will collect about that consumer, and it responds within 60 days, extendable once by 30 days with notice to the consumer (NRS 603A.345(3) and (4)); NRS 603A.346 imposes the same duties on a data broker for covered information it has purchased or will purchase. An operator violates the notice section if it knowingly fails to remedy a first failure within 30 days of being informed, knowingly fails again after a previous failure, or publishes a notice containing a knowing and material misrepresentation or omission likely to mislead a reasonable consumer (NRS 603A.350). The Attorney General enforces the sections and the district court may issue a temporary or permanent injunction or impose a civil penalty not to exceed $5,000 for each violation; the remedies are not exclusive, and no private right of action is created (NRS 603A.360).

Key Elements

• Operator (NRS 603A.330)

A person that owns or operates a commercial Internet website or online service, collects and maintains covered information from Nevada residents who use it, and has a constitutional nexus with Nevada; hosts, processors, HIPAA entities, vehicle manufacturers and repairers, and non-collectors are excluded.

• Consumer and covered information (NRS 603A.310 and 603A.320)

A person acquiring goods, services, money or credit for personal, family or household purposes from the operator; first and last name, physical address, email address, telephone number, Social Security number, a contact identifier, or other collected information held with such an identifier.

• Sale (NRS 603A.333)

The exchange of covered information for monetary consideration by an operator or data broker to another person, excluding disclosures to processors, to direct-relationship providers of a requested product or service, for purposes within the consumer's reasonable expectations, to affiliates, and as assets in a merger, acquisition or bankruptcy.

• Designated request address and verified request (NRS 603A.325, 603A.337 and 603A.345)

An email address, toll-free telephone number or website for requests; a request the operator can reasonably verify as authentic and as the consumer's own; a 60-day response, extendable once by 30 days.

• Privacy notice (NRS 603A.340)

Categories of covered information and of third parties, any review-and-change process, how material changes are announced, cross-site third-party collection and the effective date; small in-state operators with fewer than 20,000 unique visitors a year and primarily offline revenue are exempt.

• Data brokers and cure (NRS 603A.323 and 603A.346 to 603A.349)

Since SB 260 (2021), data brokers carry the designated request address and no-sale duties for information they purchase; a first failure by an operator or data broker may be remedied within 30 days after being informed of it.

What does it cover?

NRS 603A.300 to 603A.360 apply to operators of commercial Internet websites and online services that collect and maintain covered information from Nevada residents and have sufficient nexus with the state, and, since SB 260, to data brokers that purchase and sell covered information about Nevada consumers (NRS 603A.323 and 603A.330). They reach only information collected through a website or online service (NRS 603A.320) and only one transaction, the sale for monetary consideration (NRS 603A.333). Third-party hosts and processors, HIPAA covered entities and vehicle manufacturers and repairers are not operators, and consumer reporting agencies, FCRA, fraud-prevention, public, DPPA and GLBA data and consumer health data are outside the sections (NRS 603A.330(2) and 603A.338). A data collector that is also an operator complies with both the breach and security provisions of NRS 603A.010 to 603A.290 and these sections (NRS 603A.100(2)).

What are its objectives?

SB 220's title states its purpose: an act relating to Internet privacy, prohibiting an operator that collects certain information from Nevada consumers from making any sale of information about a consumer if so directed by the consumer.

Give every Nevada consumer a working channel, the designated request address, to direct an operator or data broker not to sell covered information about them (NRS 603A.325, 603A.345 and 603A.346).

Bind the operator or data broker to that direction for information already collected and information collected later (NRS 603A.345(3) and 603A.346(3)).

Fix a response time of 60 days, extendable once by 30 days with notice (NRS 603A.345(4) and 603A.346(4)).

Keep the privacy notice accurate on what is collected, who receives it and when it changed (NRS 603A.340 and 603A.350(3)).

Give the Attorney General injunctions and a civil penalty of up to $5,000 per violation, with a 30-day cure for a first failure (NRS 603A.347 to 603A.360).

Framework in Context

SB 220 sits inside NRS chapter 603A, Nevada's security and privacy of personal information chapter. NRS 603A.010 to 603A.290 govern data collectors, their security measures and breach notification; NRS 603A.300 to 603A.360 govern operators and data brokers online; and NRS 603A.400 to 603A.550, added in 2023, govern consumer health data separately and are expressly excluded from the SB 220 sections (NRS 603A.338(6)). The statute confers no access, deletion or correction rights: the NRS 603A.340 notice describes a review-and-change process only if one exists. Businesses that also answer to the comprehensive state privacy acts in the mapping list below usually fold the Nevada designated request address into the same request intake, and the operator exclusions for GLBA financial institutions and HIPAA entities mirror the exemptions those acts carry.

Common Framework Mappings

Organizations map the NRS 603A.340 notice, the 603A.345 and 603A.346 request duties and the 603A.333 definition of sale to the frameworks below so that one privacy notice, one request workflow and one disclosure register serve Nevada and every other regime they answer to.

Mapped frameworks include:

CCPA/CPRA

CIS Controls v8.1

COBIT 2019

GDPR

HIPAA

ISO 27001:2022

NIST CSF 2.0

NIST Privacy Framework v1.0

NIST 800-53 Rev.5

SOC 2