Meet Nevada SB 220 opt-out of sale rules with confidence

Nevada SB 220 is a 2019 state law that gives consumers the right to opt out of the sale of covered information collected by websites and online services. It amended Nevada's online privacy law in NRS Chapter 603A, took effect on 1 October 2019 and added NRS 603A.345, which requires operators to set up a designated request address and stop selling a consumer's data once they receive a verified request.

Operators must comply: businesses that own or operate a commercial website or online service, collect and maintain covered information from Nevada residents, and have a sufficient connection with Nevada. Location does not matter. Exclusions include third parties processing data for a website owner, HIPAA covered entities, certain motor vehicle manufacturers and servicers, and, after 2021 amendments, GLBA financial institutions, consumer reporting agencies and fraud prevention activity.

A sale is the exchange of covered information for monetary consideration to another person. As passed in 2019, the recipient also had to license or sell the data on, but a 2021 amendment removed that condition. Disclosures to processors, to affiliates, to parties providing a service the consumer requested, for purposes consistent with the consumer's reasonable expectations, and as part of a merger or acquisition are excluded.

An operator must respond to a verified opt-out request within 60 days of receiving it. It may extend that period by up to 30 days if the extension is reasonably necessary, but must tell the consumer about the extension. Requests arrive through a designated request address, which can be an email address, a toll-free telephone number or a website.

The Nevada Attorney General enforces the law. A district court can issue a temporary or permanent injunction or impose a civil penalty of up to $5,000 for each violation of the notice or opt-out duties. There is no private right of action. Operators that have not failed before can remedy a first failure within 30 days of being told about it.

Nevada SB 220 is much narrower than California's CCPA. It gives one main right, opting out of the sale of covered information, and defines sale more narrowly as an exchange for money. It has no access or deletion rights and no revenue threshold for operators. Many businesses handle both laws with a single opt-out process, but each needs its own scope check.

SB 220 covers the opt-out of sale right for online operators under NRS 603A.300 to 603A.360. Nevada later added data broker opt-out duties in 2021 and a separate consumer health data law in 2023, which has its own rules and is excluded from the SB 220 provisions. Businesses with Nevada customers should check each of these laws separately.

Yes. Nevada SB 220 is supported in OneClickComply today. Its notice and opt-out duties are mapped to privacy controls you may already run for other frameworks, so shared evidence is reused. AutoComplete can generate your privacy notice and opt-out procedure, and our in-house auditors can review your approach. OneClickComply does not certify compliance with the law.