Consumer rights and compliance under Nevada privacy law

What is the Nevada Privacy of Information Collected on the Internet from Consumers Act?

The NPICICA is a data privacy law that regulates how personal data gathered by websites and online service providers is collected and managed. It has undergone enhancements with amendments in both 2019 and 2021 to better address the evolving digital landscape.

Organizations that fall within NPICICA’s purview must clearly communicate on their websites which types of consumer data are being collected and the purposes for which data is collected.

What are the amendments to the NPICICA?

Amendment SB-220 created the right for consumers to opt out of the sale of their personal information collected online. It required website operators to establish a designated request address — either an email address, toll-free telephone number, or website — through which consumers could make an opt out request. The Act went into effect on October 1, 2019, making Nevada one of the first states to enable consumers to opt out of sale of their data. 

Nevada’s data privacy law is not typically considered one of the comprehensive modern US state-level privacy laws, however, because like Florida’s Digital Bill of Rights (FDBR), it’s narrower in scope than many other state-level laws like California’s Consumer Privacy Act (CCPA) and Virginia’s Consumer Data Protection Act (VCDPA).

Amendment SB-260, which came into effect on October 1, 2021, expanded the scope of the Act to include not just website operators, but also data brokers, and expanded the definition of “sale” to give more rights to Nevada residents.

Who does the NPICICA protect?

The Nevada privacy law protects Nevada residents defined as consumers under the Act, “a person who seeks or acquires, by purchase or lease, any good, service, money or credit for personal, family or household purposes from the Internet website or online service of an operator.”

The NPICICA protects the “covered information” of consumers, which includes any one or more of the following items of personally identifiable information:

• first and last name
• physical address
• email address
• telephone number
• social security number
• an identifier that allows an individual to be contacted
• any other information concerning a person, collected from the person, in combination with an identifier in a form that makes the information personally identifiable

The law has a limited definition of what constitutes data, i.e. covered information, the sale of which a user can stop. It narrows the definition to data collected through websites or online services, which excludes data obtained through other means but that is equally usable in identifying the user.

The concept of covered information is crucial when it comes to consent management, as it is specifically defined in the law as the information that can be sold and from which consumers have the option to opt out, rather than just as personal information.

Who does the NPICICA apply to?

The Nevada data privacy law applies to any entity that:

• owns or operates a website or an online service for commercial purposes
• collects and maintains covered information of consumers who are Nevada residents and use or visit the website or the online service
• participates in business activities targeted at Nevada, engaging in transactions with the state or with its inhabitants

Exceptions to who must comply with the Nevada privacy law

The Nevada privacy law provides for certain exceptions to compliance requirements, including:

• third parties that operate, host, manage, or process information of a website or online service on behalf of its owner for business purposes
• entities subject to the Health Insurance Portability and Accountability Act (HIPAA)
• a manufacturer of a motor vehicle or person who repairs or services a motor vehicle (in specified circumstances)
• a person who doesn’t collect, maintain or sell covered information
• a consumer reporting agency
• financial institutions (and their affiliates) subject to the Gramm-Leach-Bliley Act (GLBA)
• businesses located in Nevada that generate revenue primarily from a source other than their website or online service and have fewer than 20,000 website visitors per year

Unlike several other state privacy statutes, Nevada’s privacy laws don’t set benchmarks based on revenue or the volume of consumers’ personal data processed or sold each year. The NPICICA only covers data collected or used for activities on websites or online services.

Amendment SB-260 expanded the scope of the NPICICA to include not just website owners and operators but also data brokers. These are defined as persons whose primary business is purchasing covered information about consumers with whom they do not have a direct relationship, from operators or other data brokers and selling such covered information, and who reside in Nevada.

Nevada privacy law and the right to opt out of sale

The Nevada privacy law, as amended by SB-220, requires website operators to provide a way for Nevada residents to opt out of having their data sold.

Unlike the California Consumer Privacy Act (CCPA), which requires websites to have a “Do Not Sell or Share My Personal Information” link on the consent banner, Nevada law requires operators and data brokers to establish a toll-free number, email address, or a website where visitors can submit a verified request to opt out of the sale of their personal data.

The law also requires websites to respond to a verified consumer request to opt out within 60 days of its receipt, with a possible extension of 30 days.

Nevada law doesn’t require operators and data brokers to acknowledge “universal opt-out signals,” also known as Global Privacy Control (GPC). This tool enables users to establish their privacy settings in a single instance, in their browser when they visit a website, with the expectation that these settings are saved and will be honored across various online platforms, accessed via the browser, eliminating the need to set preferences on every individual site they engage with. 

It is becoming more common with state-level privacy laws passed that they include language requiring compliance with this signal.

How does the Nevada privacy law define sale?

The original definition of sale under the NPICICA was “the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons”.

Amendment SB-260 made two revisions to that definition of sale.

1. It removed the phrase “for the person to license or sell the covered information to additional persons”, removing the requirement that the transaction should be for the purpose of allowing the recipient to license or sell the information.
2. It expanded the scope of the term to include data brokers.

Sale is, therefore, more simply defined as “the exchange of covered information for monetary consideration by an operator or data broker to another person.”

This means that only the literal selling of personal information to third parties, i.e. in exchange for money, is considered a sale in the Nevada privacy law.

What’s more, the Nevada data privacy law has five exceptions to what constitutes “sale”.

These inclusions are all disclosures:

• of personal information to a processor different from the operator or data broker
• to an associate of the operator or data broker and disclosure to an entity that provides the person with services requested by the consumer
• consistent with the expectations of the consumer considering the context in which the consumer provided the covered information to the operator
• to a person with whom the consumer has a direct relationship for the purposes of providing a product or services requested by the consumer
• in the context of merger, acquisition, bankruptcy, or other transaction in which a person assumes control of all or part of the assets of the operator or data broker

Compliance with the Nevada privacy law

To achieve compliance with the Nevada privacy law, operators and data brokers that cater to consumers in Nevada must follow certain obligations set by the NPICICA.

NPICICA privacy policy requirements

Websites that cater to users in the state must update their privacy policy or privacy notice to include the following information:

• types of information the operator collects
• any third parties the operator might share this information with
• details on third parties that might gather information across multiple sites, such as through cookies
• information on how users can exercise their rights over their data, including the right to opt out of their personal information being sold
• Information on how the operator notifies website visitors of changes to the privacy policy
• the date when the privacy policy goes into effect and how updates to the policy will be communicated to users

Operators can use a consent management platform (CMP) to identify and manage the cookies and tracking technologies on websites. A CMP can also help create a detailed privacy policy that is automatically updated.

Consumer requests regarding their covered information under the NPICICA

Operators and data brokers must create and make available a designated request address, such as an email address, a web form, or toll-free number, for consumers to submit verified opt-out requests.

At any time, consumers have the right to request operators or data brokers not sell any covered information about them, whether already gathered or to be collected in the future. Consumers are required to provide sufficient details to enable their identities to be reasonably verified by the operator before the request is acted upon. If a requesting consumer cannot be reasonably verified, the operator can refuse to fulfill the request.

On receiving an opt-out request, the operator or data broker must stop the sale of the requester’s covered information. They are mandated to act on verified requests from consumers within 60 days of receipt. This response period may be extended once, by up to 30 days, if they need more time. The consumer must be informed about why the extension is necessary and how much longer it will take.

Consequences of noncompliance under the NPICICA

Noncompliance with Nevada’s data privacy law can be a costly affair for operators and data brokers. The law authorizes the Nevada Attorney General to fine websites, companies, and other organizations up to $5,000 per violation of the requirements under the privacy policy and consumers’ right to opt out.

The Attorney General can also seek either a temporary or a permanent injunction to halt the infringing activity, such as stopping the collection of data.

A private right of action for users, however, does not exist in the law, so consumers cannot directly sue an organization if they are victims of a violation. To date in the US only California’s privacy laws include that right.

The Nevada privacy law has no opt-in requirements, so no prior consent requirements, as we’ve come to know from the European GDPR. Organizations don’t typically have to obtain valid consent before collecting or processing data in most cases. Compliance with the core of the amendment comes down to knowing what data you collect and who you sell it to (third parties), as you provide users with a clear way to opt out of these sales.

FAQ