{
 "jurisdiction_id": "US-NV",
 "jurisdiction": "United States – Nevada",
 "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 24,
  "sub_modules": 57,
  "source_register": 18
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A real, in-force statutory floor exists (breach notification + two narrow sectoral add-ons) but there is no comprehensive material/territorial scope comparable to an omnibus regime.",
   "claims": [
    {
     "statement": "The Nevada Attorney General is the exclusive enforcement authority for Nevada's opt-out-of-sale statute (SB 220), with power to bring district-court proceedings and impose civil penalties of up to $5,000 per violation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevadas-consumer-opt-out-bill-to-go-into-effect-oct-1/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Unlike the California Consumer Privacy Act, Nevada's SB 220 is not a comprehensive privacy statute: it does not provide proportional data-portability rights and lacks an explicit anti-discrimination clause for consumers who opt out.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "SB 220's 'covered information' is defined in NRS 603A.320 to include name, physical address, email address, telephone number, Social Security number, an online/physical contact identifier, and other information maintained in combination with such an identifier.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "SB 220 applies to any operator of an online service, whether located inside or outside Nevada, that purposefully directs activity toward the state or otherwise has sufficient constitutional nexus, but does not apply to offline commercial activity.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/a-comparison-of-the-ccpa-with-new-privacy-laws-in-maine-nevada/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Nevada Senate Bill 199 (introduced February 11, 2025) would require AI companies operating in Nevada to register with the Bureau of Consumer Protection and conduct semi-annual self-assessments; enactment status is unconfirmed as of this research pass.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/node/642218",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "amber",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Sensitive-category and consent-adjacent rules exist only within the narrow consumer-health-data statute; there is no general Article 6/Article 7-style regime.",
   "claims": [
    {
     "statement": "Under SB 370, entities may collect and share consumer health data for purposes 'necessary' to meet a consumer's request without obtaining explicit consent, but neither SB 370 nor its Washington model law defines what qualifies as 'necessary.'",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/assessing-necessity-under-state-health-privacy-laws",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "SB 370 was explicitly drafted to address discrimination, stigma and harm risks associated with data on sexual activity, gender identity, reproductive health, and mental health, requiring conservative collection and sharing of such data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/assessing-necessity-under-state-health-privacy-laws",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "amber",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "A narrow, single-purpose opt-out right with a defined response deadline exists; the broader DSR bundle (access/erasure/portability) is absent.",
   "claims": [
    {
     "statement": "SB 220 provides Nevada consumers with the ability to submit a verified request directing an operator not to sell certain covered information collected via a website or online service.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Operators receiving a verified opt-out request under SB 220 must respond within 60 days of receipt, with an available 30-day extension if the operator determines it reasonably necessary and notifies the consumer.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Security and breach-notification duties are well-established and enforced; accountability-style duties (DPIA, DPO, ROPA, joint controllership) are entirely absent.",
   "claims": [
    {
     "statement": "Nevada's Privacy and Security of Personal Information chapter (NRS 603A) imposes a statutory duty on data collectors to implement and maintain reasonable security measures to protect personal information they maintain.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/legal-research/nevada-revised-statutes-chapter-603a-security",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "When the Nevada Attorney General's office receives notice of a data breach that may impact a large number of Nevadans, it conducts an investigation, typically with the assistance of the affected company, into how the breach occurred and what security measures were in place.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/a-conversation-with-nev-attorney-general-aaron-ford",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "NRS 603A.200 establishes a statutory obligation regarding destruction of certain records containing personal information in Nevada.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/legal-research/nevada-revised-statutes-chapter-603a-section-200-destruction-certain-records",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "Complete absence of a state-level cross-border/adequacy/localisation regime; this is a legitimate finding rather than a research gap.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Financial and health overlays are well documented; five of seven sub-modules have no identified Nevada-specific content.",
   "claims": [
    {
     "statement": "SB 220 amends the definition of 'operator' to exclude a third party that operates, hosts, or manages a website or online service on behalf of a financial institution, or its affiliates, subject to the Gramm-Leach-Bliley Act.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Nevada's SB 370, a consumer health data privacy law modeled on Washington's My Health My Data Act, received final legislative passage and took effect March 31, 2024, and unlike the Washington law does not carry a private right of action.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/b/nevada-passes-health-data-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "SB 220 excludes from its 'operator' definition entities subject to the Health Insurance Portability and Accountability Act (HIPAA), avoiding duplicative obligations for HIPAA-regulated entities.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "amber",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "A narrow sale-opt-out and cross-context 'sale' definition exist; most other adtech sub-domains are unaddressed by Nevada statute.",
   "claims": [
    {
     "statement": "Nevada's SB 220 applies to any operator of online services, within or outside Nevada, but not offline, and its definition of 'selling' is more narrowly defined than under the CCPA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/a-comparison-of-the-ccpa-with-new-privacy-laws-in-maine-nevada/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "SB 220 requires operators to provide a 'designated request address' -- an email address, toll-free telephone number, or website -- for accepting verified opt-out requests, rather than mandating support for automated browser-based opt-out signals.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Some emergent signals exist (SB 370 profiling exemption, proposed SB 199) but the regime is immature, partly proposed, and unconfirmed on biometric/genetic scope.",
   "claims": [
    {
     "statement": "SB 370 was amended before final passage by the Nevada State Assembly to include an exemption for profiling that does not include personal health data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/b/nevada-passes-health-data-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Nevada Senate Bill 199, introduced February 11, 2025, would require AI companies to register with the Bureau of Consumer Protection and conduct semi-annual self-assessments to ensure compliance with legal and ethical standards.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/node/642218",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "In a 2019 interview, Nevada's Attorney General recommended the state legislature follow other states in classifying biometric data (fingerprints, voice, retinal images) as 'personal information' protected under Nevada's privacy laws, implying biometric data was not then covered.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/a-conversation-with-nev-attorney-general-aaron-ford",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "red",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "No Nevada-specific statutory protections for children or vulnerable groups were located; this is treated as a legitimate gap finding.",
   "claims": []
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-nevada/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Powers, penalties, and PRA status are well documented (green-level clarity); enforcement-activity index, funding/capacity, and Nevada-specific 180-day developments are largely absent.",
   "claims": [
    {
     "statement": "If the Nevada Attorney General believes an operator has violated NRS 603A.340 or SB 220, the Attorney General may institute legal proceedings in district court, which may issue a temporary or permanent injunction or impose a civil penalty of no more than $5,000 per violation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/nevada-passes-consumer-opt-out-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Nevada Attorney General's office conducts investigations, usually with company cooperation, when it receives notice of a data breach that may impact a large number of Nevadans, and may decide to take further action depending on the facts.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/a-conversation-with-nev-attorney-general-aaron-ford",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Nevada Attorney General's office has sole responsibility for enforcement of SB 220, meaning consumers cannot independently bring collective or class actions for its violation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/a-conversation-with-nev-attorney-general-aaron-ford",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Unlike Washington's My Health My Data Act, Nevada's SB 370 does not carry a private right of action, leaving enforcement exclusively with the Attorney General.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/b/nevada-passes-health-data-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  }
 ]
}