Nevada grants consumers the right to opt out of data sales

On May 29, Nevada Governor Steve Sisolak signed the Senate Bill (SB-220) into law, making Nevada the first state to grant consumers the right to opt out of the sale of their personal information.

The bill prohibits the operator of websites or online services from selling consumer information in Nevada if a consumer chooses to opt-out.

The Privacy and Security of Personal Information Chapter of the Nevada Revised Statutes (603A) defines an “operator” as an individual who owns or operates a website or online service for commercial purposes and collects and maintains information from consumers that reside in Nevada.

Under the new bill (SB-220), an operator is required to provide consumers with notice of a designated email, toll-free phone or website address to submit opt-out requests. Additionally operators have 60 days to respond to “verified requests” to opt-out.

Although the opt-out concept is similar to the California Consumer Privacy Act (CCPA), there are slight differences. For one Nevada’s definition of “sale” is narrower than CCPA and is now defined as the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons”.

Secondly, SB-220 also employs a narrower definition of “personal information” than the CCPA. Under the bill personally identifiable information is now limited to:

  • A first and last name,
  • A home or other physical address
  • An email
  • A telephone number
  • A Social Security number
  • An identifier that allows a specific person to be contacted either physically or online
  • Any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operators in combination with an identifier in a form that makes the information personally identifiable.

The Nevada Attorney General is charged with enforcing SB-220. If the attorney general believes that an operator has violated the bill, the district court could issue a temporary or permanent injunction, or impose a civil penalty of no more than $5,000 per violation.

No specific effective date has been given therefore under Nevada law, the bill will automatically come into effect on October 1, 2019, thus coming into force before the CCPA.

Join our free-to-attend digital event, Last Thursday in Privacy, addressing data protection, privacy and security challenges including working from home, COVID-19, global regulations and more. Visit

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.