Nevada
Nevada online privacy notice law (NRS 603A)
Nevada’s website privacy notice law. Applies to websites that collect personal information from Nevada residents.
- Status
- In effect since October 1, 2017
- Citation
- Nev. Rev. Stat. §§ 603A.300–.360
- Official text
- Read the law(opens in a new tab)
Who it covers
Website operators that collect personal information from Nevada residents (small Nevada-based sites with under 20,000 visitors a year are exempt).
What it asks of your website
- Post a privacy notice listing the data collected and the third parties it’s shared with.
- Show the notice’s effective date and how people can review and correct their data.
- Give a designated address (email, form or phone) where people can opt out of the sale of their data.
Who has to comply
Nevada’s online privacy law (NRS 603A.300 to .360) applies to anyone who owns or operates a website or online service for commercial purposes, collects covered information from Nevada residents, and directs its activities to Nevada or does business with a Nevadan. There’s no size threshold. Since 2021 it also covers data brokers.
One narrow exemption from the notice duty: operators located in Nevada that make most of their revenue offline and have fewer than 20,000 unique visitors a year.
What the privacy notice must say
- The categories of covered information you collect, and the categories of third parties you may share it with.
- How consumers can review and request changes, if you offer that.
- How you tell consumers about material changes.
- Whether third parties may collect information about a consumer’s online activity over time and across sites.
- The notice’s effective date.
The right to opt out of sale
Every operator must set up a designated request address: an email address, toll-free number or website. Once a consumer sends a verified request, you may not sell any covered information you have or will collect about them. Respond within 60 days, extendable by up to 30 with notice.
Nevada defines “sale” narrowly: exchanging covered information for money. Sharing with processors and affiliates, or as part of a merger, isn’t a sale.
Enforcement
The Attorney General enforces the law and can seek an injunction and civil penalties of up to $5,000 per violation. There’s no private right of action. A first-time operator gets 30 days to fix a notice problem.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Nevada let consumers opt out of the sale of their data?
Yes. Operators must offer a designated request address and stop selling after a verified request.
What counts as a sale in Nevada?
Exchanging covered information for money. Sharing with processors or affiliates isn’t a sale.
How long do I have to respond?
60 days, extendable by up to 30.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
