Nevada

An artificial intelligence provider may not represent, or program an AI system to represent, that the system is capable of providing professional mental or behavioral health care, that a user may interact with the system to obtain such care, or that the system or any component of it is a therapist, counselor, psychiatrist or similar provider; nor may a provider make available an AI system specifically programmed to provide a service that would constitute the practice of professional mental or behavioral health care if provided by a natural person.

A natural person who lacks a valid credential to practice professional mental or behavioral health care in Nevada may not represent himself or herself as qualified to do so, including by using titles such as therapist, psychotherapist or counselor.

The Nevada Division of Public and Behavioral Health, Department of Health and Human Services, may investigate potential violations and bring a civil action to recover a civil penalty of up to $15,000 per violation; the section does not prohibit self-help materials that do not purport to offer professional care, or an AI system a licensed provider uses for administrative support consistent with NRS 629.610.

Nevada's existing unlawful-dissemination-of-intimate-image crime, NRS 200.780, already reached a photograph, film, videotape or other recorded image; a 2025 amendment to the definition of "intimate image" at NRS 200.770 added a photorealistic, digital, computer, or computer-generated image that a reasonable person would believe depicts an identifiable person's genitals, anus, or fully exposed female nipple, or an identifiable person engaged in sexual conduct.

A person who knowingly distributes such an AI-generated or digitally altered image of an identifiable person, created in a way that would lead a reasonable person to believe it is an actual depiction of that person, without the person's prior consent, is guilty of a category D felony; a person convicted is not required to register as a sex offender.

The enrolled act contains no specifically prescribed effective date, so Nevada's default rule (effective the October 1 following passage where none is prescribed) fixes the commencement at October 1, 2025, correcting an earlier tracker's claim of January 1, 2026.

A 2025 amendment to NRS 200.700 expanded the definition of "computer-generated child sexual abuse material" to include a visual representation appearing to depict a child as the subject of a sexual portrayal or engaging in sexual conduct where the representation is created by the use of artificial intelligence or other computer technology capable of processing and interpreting specific data inputs, and is indistinguishable from an actual minor to an ordinary viewer.

NRS 200.725 makes it unlawful to knowingly prepare, advertise or distribute computer-generated child sexual abuse material; a first offense is a category B felony (one to fifteen years' imprisonment, a fine of up to $15,000, or both), and a subsequent offense is a category A felony (ten years to life with the possibility of parole, and a fine of up to $15,000).

The enrolled act contains no specifically prescribed effective date for these provisions, so Nevada's default rule (effective the October 1 following passage where none is prescribed) fixes the commencement at October 1, 2025.

A Nevada-licensed provider of mental and behavioral health care (psychiatrists, psychologists, licensed social workers, psychiatric nurses, marriage and family therapists, and certain counselors) may not use an artificial intelligence system in connection with providing professional mental and behavioral health care directly to a patient, except that the provider may use AI for administrative support such as scheduling, records management, billing, operational data analysis, and organizing session notes, subject to compliance with federal and Nevada health-privacy law and to the provider's own independent review of any AI-generated report or data.

A provider who violates this section is guilty of unprofessional conduct and subject to disciplinary action by the licensing board, agency or other entity that licenses or certifies the provider.

A paid communication made in support of or opposition to a candidate, group of candidates or political party, or that solicits campaign contributions, must carry a clear and conspicuous disclosure reading "This (image/video/audio) has been manipulated" whenever it includes synthetic media, meaning an image, audio or video recording intentionally manipulated using generative adversarial network techniques, artificial intelligence or generative AI to realistically but falsely depict a person's appearance, speech or conduct.

A video disclosure must run for the entire video; an audio disclosure must be read clearly at the start, at the end, and, for audio longer than two minutes, at intervals of no more than two minutes.

A depicted candidate whose likeness appears in a non-disclosing communication may seek an injunction or other equitable relief in district court against whoever made or paid for it; the section does not impose liability on a streaming, interactive computer, cloud or internet service provider, a broadcaster or cable or satellite operator, a programmer or producer of broadcast content, or a publisher of synthetic media as satire or parody.

A data collector that owns or licenses computerized data including personal information must disclose a breach of security to an affected Nevada resident in the most expedient time possible and without unreasonable delay, with no fixed numeric deadline, unlike every other statute in this batch. Consumer-reporting-agency notice is required once more than 1,000 persons are notified at one time; no requirement to notify the Nevada Attorney General appears in the text read.

"Personal information" for breach purposes never includes biometric data, so a biometric-only breach does not trigger this duty. A separate section grants a data collector its own civil action against whoever caused the breach, which is not a consumer's private right of action.

But NRS 603A.260 deems any violation of NRS 603A.010 to 603A.290, which includes this breach duty, a deceptive trade practice under NRS 598.0903 to 598.0999, and NRS 598.0977 gives an elderly or disabled Nevada resident harmed by a deceptive trade practice a standalone civil action for actual and punitive damages and attorney's fees; that route is not excepted for this chapter the way it is for NRS 603A.550's consumer health data chapter.

So a general Nevada resident still has no private right of action for a breach-notification violation, but an elderly or disabled resident does, indirectly, through this deeming-plus-UDAP chain. The section's own history note ("Added to NRS by 2005, 2504; A 2023, 3481") gives no printed effective date, so none is recorded here.

A regulated entity processing consumer health data must give a Nevada consumer the right to access it, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it, sector-scoped to health data rather than a general personal-data right. A controller must respond within 45 days, with one 45-day extension available, and must provide two free responses per consumer per year.

This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

An operator of a commercial internet website or online service directed at Nevada residents, or a data broker, must post a privacy notice and, on request, may not sell a Nevada consumer's covered information after the consumer directs it not to.

"Covered information" is limited to name, address, email, phone, Social Security number, and similar contact identifiers plus a catch-all for information maintained with an identifier in personally identifiable form; it never reaches biometric or sensitive-category data as a class. A first-time failure to comply may be cured within 30 days without violating the statute.

This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

Nevada's only enacted biometric-data definition binds a controller only when the biometric data is related to a health condition, diagnosis, treatment, or similar information, making it "consumer health data" under this chapter; it does not operate as a general biometric-privacy statute.

"Biometric data" is defined broadly, including imagery of a fingerprint, palm print, hand print, scar, bodily mark, tattoo, voiceprint, face, retina, iris, or vein pattern, and keystroke or gait patterns or rhythms that contain identifying information, and unlike New Hampshire's, Kentucky's, Rhode Island's, and Vermont's definitions, it carries no exclusion for a photograph or recording at all, in either direction: imagery of a person's face is itself named as a form of biometric data.

A general-purpose voiceprint or faceprint collected for identification, authentication, or marketing, with no connection to health status, has no Nevada statutory home at all.

Section 205.4765 makes it unlawful for a person, knowingly, willfully and without authorization, to modify, damage, destroy, disclose, use, transfer, conceal, take, retain, copy, or obtain or attempt to obtain access to data, a program, equipment, or a computer, system or network; a bare violation is a misdemeanor, escalating to a category C felony carrying a fine of up to $100,000 where the act was committed to defraud, caused response costs or damage over $500, or interrupted a public service.

Section 205.477 separately punishes knowing, willful, malicious and unauthorized interference with or denial of access to a computer, system or network as a gross misdemeanor. Section 205.509 presumes an employee authorized to access his or her employer's own systems, and the chapter does not otherwise define how authorization is read for a member of the public accessing an unauthenticated public page.

Section 205.511 gives any victim of a crime described in this range a private civil action for response costs, loss or injury, punitive damages, and attorney's fees, independent of any criminal charge or conviction, and section 205.513 lets the Attorney General or the appropriate district attorney seek an injunction.

A data collector that accepts a payment card in connection with a sale of goods or services must comply with the current Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, not later than the compliance date the standard itself sets.

A data collector to which that duty does not apply must not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside its secure system, and must not move a data storage device containing that personal information beyond its logical or physical controls, unless the data collector encrypts the information using a standards-body-adopted encryption technology with appropriate cryptographic key management.

A data collector that complies with this section, and whose breach was not caused by its own gross negligence or intentional misconduct, is not liable for damages for a breach of the security of the system data. The section does not reach a telecommunication provider acting solely to convey the communications of other persons.

A data collector that maintains records containing the personal information of a Nevada resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

A data collector that is a governmental agency must, to the extent practicable, additionally comply with the current CIS Controls published by the Center for Internet Security or corresponding National Institute of Standards and Technology standards for the collection, dissemination, and maintenance of those records. A contract disclosing a Nevada resident's personal information must require the recipient to implement and maintain the same reasonable-security duty.

Compliance with a state or federal law requiring greater protection for the same records is deemed compliance with this section.