On May 29, Nevada passed Senate Bill 22¹ (SB 220), which amends its existing privacy law and provides consumers with the right to opt-out of the "sale" of their personal information.² The law offers a new definition of "sale," unlike those seen in recently passed privacy laws such as the California Consumer Privacy Act (CCPA), and requires operators of websites or online services to establish one of three prescribed methods for consumers to submit opt-out requests. Operators must also verify and respond to requests within the mandatory 60-day time period. With an effective date of October 1, 2019, covered operators have less than five months to comply with the state's new requirements.

Who is Covered?

SB 220 amends Nevada's existing online privacy law, passed in 2017, which applies to operators of websites or online services that do business in Nevada or otherwise direct their activities to the state, and collect Nevada consumers' personal information, or "covered information."

Operators subject to GLBA and HIPAA, motor vehicle manufacturers and servicers, and service providers will be exempted from Nevada's new requirements.

What Must Covered Operators Do?

Operators must generally provide consumers with a notice (such as a privacy notice or privacy policy) that details the categories of personal information collected, explains how consumers may request changes to personal information about them, describes how consumers will be notified of material changes to the notice, and states whether a third party may collect consumers' personal information.

Under the amended law, Nevada consumers will have the right to opt-out of the "sale" of their personal information, which the law defines as a disclosure of personal information in exchange for monetary consideration to a person that will sell or license the information to others. This includes information that an operator currently sells or will sell in the future. In the next few months, operators will have to determine whether any disclosures, or potential disclosures, of personal information constitute a "sale."

SB 220 also requires operators to establish a "designated request address"—an email address, a toll-free number or a website—to allow Nevada consumers to submit "verified requests." That is, operators must reasonably verify the legitimacy of the opt-out requestand the consumer's identity using "commercially reasonable means"—a term the Nevada legislature left undefined.

Operators will have 60 days to respond to opt-out requests, with the exception of a one-time 30-day extension when reasonably necessary and so long as the consumer is provided with notice of the extension.

Penalties and Enforcement

While the law does not provide consumers with a private right of action, the Nevada attorney general will be responsible for enforcing the law's requirements with a variety of enforcement mechanisms, including requests for temporary or permanent injunction or penalties up to $5,000 for each violation of the statute's notice and opt-out obligations.

Next Steps

Given the limited time frame before the new requirements take effect, operators can begin complying with Nevada's new requirements by:

• Reviewing existing data maps, processing activities and contracts to identify disclosures of personal information and third parties that re-sell personal information. Operators subject to both the CCPA and the Nevada law should assess whether to use the California standard of a "sale" to develop a universal consumer request process.

• Choosing and implementing a mechanism to allow consumers to submit opt-out requests. Operators subject to the CCPA can leverage the mechanisms required by the CCPA (i.e., website and toll-free number), but should ensure the mechanisms are in place and functioning prior to October 1.

• Documenting and recording all opt-out requests to ensure requests are verified and processed within 60 days. Operators that do not sell personal information should still record opt-out requests, as such requests will need to be respected for any future sales of personal information.

• Assessing how consumer requests will be verified. The extent of verification should generally align with the nature and sensitivity of the personal information collected.

• Updating internal policies and procedures. Operators should implement and document opt-out request processes and update their recordkeeping policies to reflect SB 220's requirements.

• Updating consumer-facing privacy policies and notices. Operators should update their consumer-facing privacy policies and notices to describe how consumers can submit opt-out requests, and should ensure that these documents include all of the information required by the Nevada law.