On May 29, Nevada passed Senate Bill 2201 (SB 220), which amends its existing privacy law and provides consumers with the right to opt-out of the "sale" of their personal information.2 The law offers a new definition of "sale," unlike those seen in recently passed privacy laws such as the California Consumer Privacy Act (CCPA), and requires operators of websites or online services to establish one of three prescribed methods for consumers to submit opt-out requests. Operators must also verify and respond to requests within the mandatory 60-day time period. With an effective date of October 1, 2019, covered operators have less than five months to comply with the state's new requirements.
Who is Covered?
SB 220 amends Nevada's existing online privacy law, passed in 2017, which applies to operators of websites or online services that do business in Nevada or otherwise direct their activities to the state, and collect Nevada consumers' personal information, or "covered information."
Operators subject to GLBA and HIPAA, motor vehicle manufacturers and servicers, and service providers will be exempted from Nevada's new requirements.
What Must Covered Operators Do?
Under the amended law, Nevada consumers will have the right to opt-out of the "sale" of their personal information, which the law defines as a disclosure of personal information in exchange for monetary consideration to a person that will sell or license the information to others. This includes information that an operator currently sells or will sell in the future. In the next few months, operators will have to determine whether any disclosures, or potential disclosures, of personal information constitute a "sale."
SB 220 also requires operators to establish a "designated request address"—an email address, a toll-free number or a website—to allow Nevada consumers to submit "verified requests." That is, operators must reasonably verify the legitimacy of the opt-out requestand the consumer's identity using "commercially reasonable means"—a term the Nevada legislature left undefined.
Operators will have 60 days to respond to opt-out requests, with the exception of a one-time 30-day extension when reasonably necessary and so long as the consumer is provided with notice of the extension.
Penalties and Enforcement
While the law does not provide consumers with a private right of action, the Nevada attorney general will be responsible for enforcing the law's requirements with a variety of enforcement mechanisms, including requests for temporary or permanent injunction or penalties up to $5,000 for each violation of the statute's notice and opt-out obligations.
Given the limited time frame before the new requirements take effect, operators can begin complying with Nevada's new requirements by:
1 See S.B. 220, 2019 80th Sess. (Nev. 2019) (available at https://www.leg.state.nv.us/Session/80th2019/Bills/SB/SB220.pdf).
2 Several other states have introduced bills that provide consumers with opt-out rights, and Maine recently passed the Act to Protect the Privacy of Online Customer Information (APPOCI), which goes into effect on July 1, and prohibits internet service providers from using, selling or disclosing consumers' personal information without consent.