Law / United States / 
Nevada
Online Privacy Notice, opt-out of sale
In force.
A privacy notice rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Post a privacy notice if you operate a commercial internet website or online service directed at Nevada residents, or act as a data broker.NIST Privacy FrameworkCM.AW-P1
- Honor a Nevada consumer's request not to sell their covered information (name, address, email, phone, Social Security number, or similar contact identifiers maintained in personally identifiable form).NIST Privacy FrameworkCT.PO-P3
- Do not treat this statute as reaching biometric or other sensitive-category data. Its covered information definition does not name any biometric identifier.
- Cure a first-time compliance failure within 30 days of notice to avoid a violation.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a disclosure of covered information to an advertising or analytics partner in return for services or other non-monetary value count as an "exchange of covered information for monetary consideration" under NRS 603A.333(1), so that the opt-out in NRS 603A.345 reaches it?
What it makes you log
Logging duty
An operator must make a privacy notice available (603A.340), establish a designated request address and honor a consumer's verified request not to sell covered information, responding within 60 days, extendable by 30 (603A.345), with a data broker bound by the same request duty (603A.346). These are notice, process and conduct duties. The chapter does not require the operator to log or keep a record of requests or sales and gives no regulator access to a record; the Attorney General enforces by action (603A.360). The operator definition reaches a person who collects covered information from consumers who reside in this State and who purposefully directs its activities toward this State.
- Kind
- None
- As of
What this law does
An operator of a commercial internet website or online service directed at Nevada residents, or a data broker, must post a privacy notice and, on request, may not sell a Nevada consumer's covered information after the consumer directs it not to.
"Covered information" is limited to name, address, email, phone, Social Security number, and similar contact identifiers plus a catch-all for information maintained with an identifier in personally identifiable form; it never reaches biometric or sensitive-category data as a class. A first-time failure to comply may be cured within 30 days without violating the statute. The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .