Nevada

An artificial intelligence provider may not represent, or program an AI system to represent, that the system is capable of providing professional mental or behavioral health care, that a user may interact with the system to obtain such care, or that the system or any component of it is a therapist, counselor, psychiatrist or similar provider; nor may a provider make available an AI system specifically programmed to provide a service that would constitute the practice of professional mental or behavioral health care if provided by a natural person.

A natural person who lacks a valid credential to practice professional mental or behavioral health care in Nevada may not represent himself or herself as qualified to do so, including by using titles such as therapist, psychotherapist or counselor.

The Nevada Division of Public and Behavioral Health, Department of Health and Human Services, may investigate potential violations and bring a civil action to recover a civil penalty of up to $15,000 per violation; the section does not prohibit self-help materials that do not purport to offer professional care, or an AI system a licensed provider uses for administrative support consistent with NRS 629.610.

Nevada's existing unlawful-dissemination-of-intimate-image crime, NRS 200.780, already reached a photograph, film, videotape or other recorded image; a 2025 amendment to the definition of "intimate image" at NRS 200.770 added a photorealistic, digital, computer, or computer-generated image that a reasonable person would believe depicts an identifiable person's genitals, anus, or fully exposed female nipple, or an identifiable person engaged in sexual conduct.

A person who knowingly distributes such an AI-generated or digitally altered image of an identifiable person, created in a way that would lead a reasonable person to believe it is an actual depiction of that person, without the person's prior consent, is guilty of a category D felony; a person convicted is not required to register as a sex offender.

The enrolled act contains no specifically prescribed effective date, so Nevada's default rule (effective the October 1 following passage where none is prescribed) fixes the commencement at October 1, 2025, correcting an earlier tracker's claim of January 1, 2026. The Nevada Legislature's list of 2025 bills that became law gives the act's effective date as October 1, 2025.

A 2025 amendment to NRS 200.700 expanded the definition of "computer-generated child sexual abuse material" to include a visual representation appearing to depict a child as the subject of a sexual portrayal or engaging in sexual conduct where the representation is created by the use of artificial intelligence or other computer technology capable of processing and interpreting specific data inputs, and is indistinguishable from an actual minor to an ordinary viewer.

NRS 200.725 makes it unlawful to knowingly prepare, advertise or distribute computer-generated child sexual abuse material; a first offense is a category B felony (one to fifteen years' imprisonment, a fine of up to $15,000, or both), and a subsequent offense is a category A felony (ten years to life with the possibility of parole, and a fine of up to $15,000).

The enrolled act contains no specifically prescribed effective date for these provisions, so Nevada's default rule (effective the October 1 following passage where none is prescribed) fixes the commencement at October 1, 2025. The Nevada Legislature's list of 2025 bills that became law gives the act's effective date as October 1, 2025.

A public utility may not make a final decision on whether to reduce or shut down utility service in response to a disaster or emergency based solely on the use of artificial intelligence. Every state emergency management plan, and every local or state agency's emergency operations plan, must include provisions ensuring that final decisions on emergency response planning and on allocating resources in an emergency are made by a natural person rather than by artificial intelligence.

For both duties, artificial intelligence means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments.

A Nevada-licensed provider of mental and behavioral health care (psychiatrists, psychologists, licensed social workers, psychiatric nurses, marriage and family therapists, and certain counselors) may not use an artificial intelligence system in connection with providing professional mental and behavioral health care directly to a patient, except that the provider may use AI for administrative support such as scheduling, records management, billing, operational data analysis, and organizing session notes, subject to compliance with federal and Nevada health-privacy law and to the provider's own independent review of any AI-generated report or data.

A provider who violates this section is guilty of unprofessional conduct and subject to disciplinary action by the licensing board, agency or other entity that licenses or certifies the provider.

A paid communication made in support of or opposition to a candidate, group of candidates or political party, or that solicits campaign contributions, must carry a clear and conspicuous disclosure reading "This (image/video/audio) has been manipulated" whenever it includes synthetic media, meaning an image, audio or video recording intentionally manipulated using generative adversarial network techniques, artificial intelligence or generative AI to realistically but falsely depict a person's appearance, speech or conduct.

A video disclosure must run for the entire video; an audio disclosure must be read clearly at the start, at the end, and, for audio longer than two minutes, at intervals of no more than two minutes.

A depicted candidate whose likeness appears in a non-disclosing communication may seek an injunction or other equitable relief in district court against whoever made or paid for it; the section does not impose liability on a streaming, interactive computer, cloud or internet service provider, a broadcaster or cable or satellite operator, a programmer or producer of broadcast content, or a publisher of synthetic media as satire or parody.

A data collector that owns or licenses computerized data including personal information must disclose a breach of security to an affected Nevada resident in the most expedient time possible and without unreasonable delay, with no fixed numeric deadline, unlike every other statute in this batch. Consumer-reporting-agency notice is required once more than 1,000 persons are notified at one time; no requirement to notify the Nevada Attorney General appears in the text read.

"Personal information" for breach purposes never includes biometric data, so a biometric-only breach does not trigger this duty. A separate section grants a data collector its own civil action against whoever caused the breach, which is not a consumer's private right of action.

But NRS 603A.260 deems any violation of NRS 603A.010 to 603A.290, which includes this breach duty, a deceptive trade practice under NRS 598.0903 to 598.0999, and NRS 598.0977 gives an elderly or disabled Nevada resident harmed by a deceptive trade practice a standalone civil action for actual and punitive damages and attorney's fees; that route is not excepted for this chapter the way it is for NRS 603A.550's consumer health data chapter.

So a general Nevada resident still has no private right of action for a breach-notification violation, but an elderly or disabled resident does, indirectly, through this deeming-plus-UDAP chain. The section was added by Senate Bill 347 of 2005 (chapter 485, Statutes of Nevada 2005), whose section 24 became effective on January 1, 2006.

A regulated entity processing consumer health data must give a Nevada consumer the right to access it, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it, sector-scoped to health data rather than a general personal-data right. A controller must respond within 45 days, with one 45-day extension available, and must provide two free responses per consumer per year.

Senate Bill 370 of 2023 (chapter 525, Statutes of Nevada 2023), which enacted these sections, became effective on March 31, 2024.

An operator of a commercial internet website or online service directed at Nevada residents, or a data broker, must post a privacy notice and, on request, may not sell a Nevada consumer's covered information after the consumer directs it not to.

"Covered information" is limited to name, address, email, phone, Social Security number, and similar contact identifiers plus a catch-all for information maintained with an identifier in personally identifiable form; it never reaches biometric or sensitive-category data as a class. A first-time failure to comply may be cured within 30 days without violating the statute. The sections this entry groups came into force on different days.

Nevada's only enacted biometric-data definition binds a controller only when the biometric data is related to a health condition, diagnosis, treatment, or similar information, making it "consumer health data" under this chapter; it does not operate as a general biometric-privacy statute.

"Biometric data" is defined broadly, including imagery of a fingerprint, palm print, hand print, scar, bodily mark, tattoo, voiceprint, face, retina, iris, or vein pattern, and keystroke or gait patterns or rhythms that contain identifying information, and unlike New Hampshire's, Kentucky's, Rhode Island's, and Vermont's definitions, it carries no exclusion for a photograph or recording at all, in either direction: imagery of a person's face is itself named as a form of biometric data.

A general-purpose voiceprint or faceprint collected for identification, authentication, or marketing, with no connection to health status, has no Nevada statutory home at all.

A person must not sell or offer to sell consumer health data without the written authorization of the consumer to whom the data pertains, or in a manner that is outside the scope of or inconsistent with that authorization. A person must not condition the provision of goods or services on a consumer authorizing the sale of consumer health data. A written authorization must be in plain language and include the consumer's signature and the date on which the authorization expires.

A written authorization expires 1 year after the date on which the authorization is given. A seller and purchaser of consumer health data must each retain a copy of the written authorization for at least 6 years after the date on which it expired. A violation of NRS 603A.400 to 603A.550, inclusive, constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive. NRS 603A.400 to 603A.550, inclusive, do not create a private right of action.

In the Nevada Revised Statutes, unless a particular statute expressly provides otherwise or the context requires otherwise, a person is a natural person, any form of business or social organization, or any other nongovernmental legal entity, including a corporation, partnership, association, trust or unincorporated organization. The act that added the section became effective on March 31, 2024.

A person must not implement a geofence within 1,750 feet of any medical facility, facility for the dependent or any other person or entity that provides in-person health care services or products for the purpose of identifying or tracking consumers seeking in-person health care services or products, collecting consumer health data, or sending notifications, messages or advertisements to consumers related to their consumer health data or health care services or products.

A geofence is technology that uses coordinates for global positioning, connectivity to cellular towers, cellular data, radio frequency identification, wireless Internet data or any other form of detecting the physical location of a person to establish a virtual boundary with a radius of 1,750 feet or less around a specific physical location. A violation of NRS 603A.400 to 603A.550, inclusive, constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive.

NRS 603A.400 to 603A.550, inclusive, do not create a private right of action. In the Nevada Revised Statutes, unless a particular statute expressly provides otherwise or the context requires otherwise, a person is a natural person, any form of business or social organization, or any other nongovernmental legal entity, including a corporation, partnership, association, trust or unincorporated organization. The act that added the section became effective on March 31, 2024.

Section 205.4765 makes it unlawful for a person, knowingly, willfully and without authorization, to modify, damage, destroy, disclose, use, transfer, conceal, take, retain, copy, or obtain or attempt to obtain access to data, a program, equipment, or a computer, system or network; a bare violation is a misdemeanor, escalating to a category C felony carrying a fine of up to $100,000 where the act was committed to defraud, caused response costs or damage over $500, or interrupted a public service.

Section 205.477 separately punishes knowing, willful, malicious and unauthorized interference with or denial of access to a computer, system or network as a gross misdemeanor. Section 205.509 presumes an employee authorized to access his or her employer's own systems, and the chapter does not otherwise define how authorization is read for a member of the public accessing an unauthenticated public page.

Section 205.511 gives any victim of a crime described in this range a private civil action for response costs, loss or injury, punitive damages, and attorney's fees, independent of any criminal charge or conviction, and section 205.513 lets the Attorney General or the appropriate district attorney seek an injunction. The 1983 act that added these provisions states no commencement day of its own.

Nevada's general rule makes a law passed by the Legislature become effective on October 1 following its passage unless it prescribes a different date.

Each political subdivision must adopt and maintain a cybersecurity incident response plan. Each new or revised plan must be filed with the Office of Information Security and Cyber Defense within 10 days after adoption or revision. Each political subdivision must review its plan at least once each year and file the revised plan or a written certification that the filed plan is current by December 31.

A data collector that accepts a payment card in connection with a sale of goods or services must comply with the current Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, not later than the compliance date the standard itself sets.

A data collector to which that duty does not apply must not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside its secure system, and must not move a data storage device containing that personal information beyond its logical or physical controls, unless the data collector encrypts the information using a standards-body-adopted encryption technology with appropriate cryptographic key management.

A data collector that complies with this section, and whose breach was not caused by its own gross negligence or intentional misconduct, is not liable for damages for a breach of the security of the system data. The section does not reach a telecommunication provider acting solely to convey the communications of other persons.

A data collector that maintains records containing the personal information of a Nevada resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

A data collector that is a governmental agency must, to the extent practicable, additionally comply with the current CIS Controls published by the Center for Internet Security or corresponding National Institute of Standards and Technology standards for the collection, dissemination, and maintenance of those records. A contract disclosing a Nevada resident's personal information must require the recipient to implement and maintain the same reasonable-security duty.

Compliance with a state or federal law requiring greater protection for the same records is deemed compliance with this section. The provisions this entry describes came into force on different days. Senate Bill 302 of 2019 (chapter 412, Statutes of Nevada 2019) added subsections 2 and 5. Section 1 of that act, which amended this section, became effective on January 1, 2021.

The original security-measures duty, in section 23 of chapter 485, Statutes of Nevada 2005, took effect on January 1, 2006.

Each using agency must report any suspected data breach, distributed denial of service incident or ransomware incident. The report is due to the Office of Information Security and Cyber Defense and the Security Operations Center within 24 hours after discovery of the suspected incident. A using agency is a state agency or elected state officer required to use the Office's services, or another state agency or local governmental agency that has negotiated for them.

A report must state the date and time of the incident and the type of incident. No day on which the provisions this entry describes came into force has been located.

A person who transmits or causes to be transmitted to a recipient an item of electronic mail that includes an advertisement is liable to the recipient for civil damages unless the person has a preexisting business or personal relationship with the recipient, the recipient expressly consented to receive it, or the advertisement is readily identifiable as promotional or says it is an advertisement and clearly gives the sender's legal name, street address and email address, a notice of how to decline further advertising mail, and the word advertisement or ADV as the first word of the subject line.

A recipient may recover actual damages or $50 per message, whichever is greater, plus attorney's fees and costs, and may separately seek an injunction. The recovery rises to actual damages or $500 per message, whichever is greater, where the sender disguised the source, used false or misleading subject-line information, gave a false return address or a false address for declining mail, ignored a request to stop, or obtained the recipient's address by a method the recipient did not authorize.

The bars on a disguised source, false or misleading subject-line information and a false return or opt-out address are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force; the labeling and opt-out conditions are not framed that way.

A provider of network access that only transmits its users' mail is immune unless it prepared the advertisement itself, and the statute does not apply to an item of mail a recipient obtains voluntarily, such as from an electronic bulletin board. The provisions this entry describes came into force on different days.

Nevada bars any person, not only a peace officer, from installing or using a pen register or a trap and trace device without first obtaining an order from a district court, except as the federal pen register and trap and trace statute otherwise provides. Nevada's general default makes an act a statute prohibits with no stated penalty a misdemeanor.

Nevada makes it unlawful for any person to intercept or attempt to intercept a wire communication unless the interception has the prior consent of one of the parties and an emergency makes it impractical to obtain a court order first, in which case the person must apply to a Supreme Court justice or district judge for ratification within 72 hours; one party's consent alone does not make an interception lawful.

A wire communication is the transmission of writing, signs, signals, pictures and sounds of all kinds by wire, cable or similar connection, and the chapter does not define intercept. The section does not apply to a provider of wire communication service, or its staff, intercepting to construct, maintain or operate its service.

A separate section bars surreptitiously listening to, monitoring or recording a private conversation engaged in by other persons with a listening device, unless one of the persons engaging in the conversation authorizes it, so one participant's authorization is enough for an in-person conversation.

Disclosing the existence, content or substance of a wire or radio communication to anyone is barred unless the sender or the receiver authorized the disclosure, apart from a service provider's disclosures to operate its service, to the intended receiver, or under a subpoena or other lawful demand.

A willful and knowing violation of any of these sections is a category D felony and gives the person whose wire or oral communication was intercepted without consent a civil action for actual damages or liquidated damages of $100 a day of violation but not less than $1,000, whichever is greater, plus punitive damages and attorney's fees. The provisions this entry describes came into force on different days.

During a solicitation by telephone or text message or a sales presentation, Nevada makes it a deceptive trade practice to use threatening, intimidating, profane or obscene language, or to repeatedly or continuously conduct the solicitation or presentation in a manner a reasonable person would consider annoying, abusive or harassing.

It is also a deceptive trade practice to solicit a person by telephone at their residence between 8 p.m. and 9 a.m., to block or otherwise intentionally circumvent a service used to identify the caller when placing an unsolicited call, or to place an unsolicited call that such a service cannot identify by telephone number or business name unless identification is not technically feasible.

Since a 2021 amendment, causing a caller-identification service for a voice or text messaging service to display inaccurate or misleading information, knowingly, to defraud a person, wrongfully obtain something of value or otherwise cause harm, is a deceptive trade practice as well.

A seller or lessor who solicits by telephone engages in a deceptive trade practice, in the course of business, unless it identifies itself, whom it represents and the purpose of the call within 30 seconds after the conversation begins. A victim of any of these practices may sue under NRS 41.600 for damages, equitable relief, costs and attorney's fees, and a knowing and willful violation is also a misdemeanor the Attorney General or a district attorney may prosecute. The sections this entry groups came into force on different days.

Nevada bars using a device for automatic dialing and announcing, equipment that stores numbers, generates them randomly or sequentially and is used exclusively to disseminate a prerecorded message soliciting a purchase of goods or services, to play its message unless a recorded or unrecorded natural voice first tells the person who answers the nature of the call, including that such a device will deliver the message if they stay on the line, and gives the name, address and telephone number of the business or organization the caller represents.

Such a device may not place a call received in Nevada between 8 p.m. and 9 a.m., or a call-back or second call to a number whose occupant ended the original call.

These rules do not reach a call to a person with whom the caller or an affiliated person has a preexisting business relationship, or a call made exclusively on behalf of a school, a nonprofit organization, a video or public utility service provider about a previously arranged installation, specified emergency warnings, or a political candidate, party or committee.

Separately, a person who in the course of business disseminates an unsolicited prerecorded message soliciting a purchase by telephone, to someone with whom there is no preexisting business relationship, engages in a deceptive trade practice unless a natural voice first gives the nature of the call and the name, address and telephone number of the business, and a recipient may sue over that practice for damages, equitable relief, costs and attorney's fees.

A violation of the device rules is a misdemeanor for a first offense, a gross misdemeanor for a second, and a category E felony for a third or later offense, and carries a civil penalty of up to $10,000 for each violation. The sections this entry groups came into force on different days.

Nevada requires a seller, defined narrowly to reach a person who causes a solicitation by telephone or a device for automatic dialing and announcing involving a free-premium or prize promotion, precious metals, gems or an oil, gas, mineral or other investment opportunity, sporting-event information, a recovery service, or a follow-up call generated by a specially-selected notification, and any salesperson acting for such a seller, to register with the Consumer Affairs Unit, post a bond, letter of credit or certificate of deposit, and pay a fee before doing business.

That registration duty reaches a seller whether calling from a location in Nevada or into Nevada from elsewhere. The registration duty excludes a person acting within the scope of a securities, real estate, timeshare, cemetery, travel-club or insurance license, a newspaper or magazine publisher or its agent, a licensed broadcaster, and several other narrowly defined categories the statute lists.

Doing business as an unregistered seller or salesperson is a category D felony, and any other willful violation of the chapter escalates from a misdemeanor to a gross misdemeanor to a category D felony over a third offense within 10 years.

Only an elderly person, one 60 or older, or a person with a disability who is damaged or injured by an unlawful solicitation by telephone may sue directly, for actual damages, punitive damages and attorney's fees; the Attorney General or a district attorney may separately seek civil penalties and criminal prosecution on behalf of any consumer. The sections this entry groups came into force on different days.

A telephone solicitor may not intentionally make an unsolicited telephone call for the sale of goods or services to a number on the currently effective version of the list of telephone numbers in the Attorney General's telephone solicitation registry, which may be the part of the national do-not-call database that relates to Nevada.

An unsolicited telephone call for the sale of goods or services covers a call to rent, lease, sell, exchange, promote or gift a good or service, to seek a donation, or to gather information for either, but not a call on behalf of a charitable, religious or political organization.

The prohibition does not reach a solicitor with a preexisting business relationship with the person called, meaning a purchase or other financial transaction directly with the solicitor, not an affiliate, within the preceding 18 months, if the solicitor keeps an internal do-not-call registry and sends each such customer an annual written notice explaining how to join it.

A violation is deemed a deceptive trade practice for the purposes of the Attorney General's enforcement powers under NRS 598.0903 to 598.0999, and the Attorney General may bring proceedings against a violator.