Nevada's Online Privacy Notice and Sale Opt-Out Law: Three Bills, One Subchapter of NRS 603A

Three Bills, One Subchapter

The part of Nevada's chapter 603A headed "Notice Regarding Privacy of Information Collected on Internet From Consumers" runs from NRS 603A.300 to 603A.360. It regulates the websites and online services that collect identifying information from Nevada residents, and since 2021 the data brokers that buy that information. It is a separate regime from the chapter's breach and security provisions at NRS 603A.010 to 603A.290 and from the consumer health data provisions that begin at NRS 603A.400.

The subchapter was built in three sessions. Senate Bill 538 of 2017, sponsored by Senator Aaron Ford and Assemblyman Jason Frierson, was introduced on May 11, 2017, passed the Senate 21 to 0 and the Assembly 42 to 0, and was approved on June 12, 2017 as Chapter 570, effective October 1, 2017. It created the definitions of consumer, covered information and operator, the notice requirement and Attorney General enforcement.

Senate Bill 220 of 2019, with Senator Nicole Cannizzaro first among five primary sponsors, added the designated request address and the verified request not to sell. It passed the Senate 21 to 0 on April 23, 2019 and the Assembly 40 to 0 on May 23, was approved on May 29, 2019 as Chapter 211, and took effect October 1, 2019.

Senate Bill 260 of 2021, also sponsored by Senator Cannizzaro, added data brokers, a list of exempt persons and information, a broader definition of sale and first-failure limits on the repair period. It passed the Senate 21 to 0, was amended in the Assembly and passed there 41 to 0 on May 21, 2021, was approved on June 2, 2021 as Chapter 292 and took effect October 1, 2021.

Operators and the Covered Information Definition

Under NRS 603A.330, an operator is a person who meets three conditions: it owns or operates an Internet website or online service for commercial purposes; it collects and maintains covered information from consumers who reside in Nevada and use or visit the site or service; and it purposefully directs activities toward Nevada, consummates a transaction with the state or a resident, or otherwise has a nexus sufficient to satisfy the United States Constitution. The third condition borrows the language of personal jurisdiction rather than setting a revenue or headcount threshold.

Four kinds of person are excluded in NRS 603A.330(2): a third party that operates, hosts or manages a site, or processes information, on behalf of its owner; an entity subject to HIPAA; a motor vehicle manufacturer or repairer as to covered information retrieved from a vehicle or provided in connection with a vehicle technology subscription; and, since 2021, a person who does not collect, maintain or make sales of covered information. NRS 603A.338, added in 2021, then takes seven categories out of the whole subchapter, including consumer reporting agencies, information regulated by the Fair Credit Reporting Act or the Driver's Privacy Protection Act, fraud prevention, publicly available information, GLBA-covered financial institutions and their affiliates, and consumer health data covered by NRS 603A.400 to 603A.550.

Covered information under NRS 603A.320 is information collected through a website or online service and "maintained by the operator or a data broker in an accessible form." Six items are listed outright: first and last name; a physical address including street and city or town; an email address; a telephone number; a Social Security number; and an identifier allowing a specific person to be contacted physically or online. A seventh category captures any other information collected through the site and kept "in combination with an identifier in a form that makes the information personally identifiable." A consumer, under NRS 603A.310, is a person who seeks or acquires goods, services, money or credit for personal, family or household purposes from the operator's site or service.

The Privacy Notice Requirements

NRS 603A.340(1) requires an operator to make a notice available "in a manner reasonably calculated to be accessible" by the consumers whose covered information it collects online. The notice has five required elements:

1. The categories of covered information collected through the site or service, and the categories of third parties with whom the operator may share it
2. A description of any process for a consumer to review and request changes to his or her covered information, if such a process exists
3. How the operator notifies consumers of material changes to the notice
4. Whether a third party may collect covered information about a consumer's online activities over time and across different websites or online services when the consumer uses the operator's site
5. The notice's effective date

The second element does not create a right to review or correct information. It requires a description of the process "if any such process exists." The fourth element is a disclosure about third-party tracking, not a restriction on it.

Subsection 2 excuses an operator that meets all three conditions: it is located in Nevada, its revenue comes primarily from a source other than selling or leasing goods, services or credit online, and its site or service has fewer than 20,000 unique visitors a year. An out-of-state operator does not qualify for this exception whatever its size.

The Verified Request Not to Sell

NRS 603A.345 requires each operator to establish a designated request address, which NRS 603A.325 defines as an email address, toll-free telephone number or Internet website through which a consumer may submit a verified request. A consumer may, "at any time," direct the operator not to sell "any covered information the operator has collected or will collect about the consumer." Once the request is received, the operator may not make any such sale.

A verified request, under NRS 603A.337, is one for which the operator "can reasonably verify the authenticity of the request and the identity of the consumer using commercially reasonable means." The operator has 60 days after receipt to respond and may extend that once by no more than 30 days if it determines the extension is reasonably necessary, notifying the consumer of the extension.

The request is prospective as well as retrospective: it reaches information the operator "will collect." The statute does not require the request to be renewed and sets no expiry.

The Attorney General's office described the 2019 change to the public in a March 4, 2020 release, listing the categories of information a Nevadan may opt out of selling, noting that transfers in a business sale or merger and transfers to vendors the operator relies on to provide purchased goods or services are not sales, and stating that an operator has 60 days to respond.

What Counts as a Sale in Nevada

Under NRS 603A.333 as amended in 2021, a sale is "the exchange of covered information for monetary consideration by an operator or data broker to another person." The SB 260 digest records what the definition said before: an exchange for monetary consideration "to a person for the person to license or sell the covered information to additional persons." The 2021 bill removed that onward-sale element, so a paid transfer to a recipient that keeps the information for its own use now falls within the definition unless an exclusion applies.

Five disclosures are excluded:

• To a person who processes the covered information on behalf of the operator or data broker
• By an operator, to a person with whom the consumer has a direct relationship, to provide a product or service the consumer requested
• By an operator, for purposes consistent with the consumer's reasonable expectations given the context in which the information was provided
• To an affiliate, as defined in NRS 686A.620
• As an asset in a merger, acquisition, bankruptcy or similar transaction in which the recipient assumes control of all or part of the assets

Monetary consideration is the dividing line. The definition does not extend to exchanges for other valuable consideration, and the statute contains no separate definition of sharing.

The 2021 Extension to Data Brokers

NRS 603A.323 defines a data broker as a person "whose primary business is purchasing covered information about consumers with whom the person does not have a direct relationship and who reside in this State from operators or other data brokers and making sales of such covered information." Both halves of that business, buying and selling, are part of the definition.

NRS 603A.346 gives consumers the same channel against a data broker that NRS 603A.345 gives against an operator: a designated request address, a verified request covering covered information the broker "has purchased or will purchase," a prohibition on selling it once the request is received, and the same 60-day response period with one extension of up to 30 days. The subchapter imposes no registration requirement and no notice requirement on data brokers.

Attorney General Enforcement and the Cure Period

The Attorney General is the only enforcer named in NRS 603A.360, which authorizes proceedings against an operator for violations of NRS 603A.340 or 603A.345 and against a data broker for violations of NRS 603A.346, with the district court able to issue an injunction or impose a civil penalty of up to $5,000 per violation. Subsection 4 states that the subchapter does not create a private right of action against an operator.

The 30-day repair period has changed shape. The 2017 digest describes a right to remedy a notice failure within 30 days after being informed of it. SB 260 limited that right to an operator that "has not previously failed to comply" and created matching first-failure repair provisions for the opt-out duties of operators (NRS 603A.349) and data brokers (NRS 603A.347). NRS 603A.350 separately makes it a violation to publish a notice containing a knowing and material misrepresentation or omission likely to mislead a reasonable consumer to his or her detriment, a ground that does not depend on a prior failure.

The Attorney General material reviewed for this post is the March 2020 consumer release, which directs consumers to the office's complaint process. It does not report an action under NRS 603A.360, and this post does not chart an enforcement record for the subchapter.

Frequently Asked Questions