When will SB 220 become effective?

October 1, 2019

Who is subject to SB 220?

Operators.

An “operator” means a person who (i) owns or operates an Internet website or online service for commercial purposes; (ii) collects and maintains covered information from consumers who reside in Nevada and use or visit the website or online service; and (iii) purposefully directs its activities towards Nevada, consummates transactions with Nevada residents, avails itself of the privileges of conducting activities in Nevada, or otherwise engages in any activity that constitutes sufficient nexus with Nevada to satisfy the US Constitution.

What information is protected?

Covered information.

Covered information means:

• first and last name,

• physical address,

• email address,

• phone number,

• social security number,

• identifier that allows a specific person to be contacted either physically or online, or

• any other information concerning a person in combination with an identifier that makes the information personally identifiable.

What obligations will operators have?

• Operators that receive a verified opt-out request from a consumer are prohibited from selling any covered information to data brokers.

• Operators must establish a designated request address through which a consumer may submit an opt-out request.

What steps should my company take between now and October 1, 2019?

• Determine whether SB 220 applies to you.

• Know and map your data: What specific pieces of personal information do you collect? Do you sell it? Do you plan to sell it?

• Update your privacy policy to provide consumers your designated request address.