Amendment to NPICICA (SB 260)

· About Amendment to NPICICA (SB 260)

Key Takeaways

  • SB 260 applies to Nevada operators and data brokers that collect covered information from Nevada residents through websites or online services, and it requires honoring consumer opt-out requests for sales of covered information.[9][15]
  • The amendment broadened “sale” to include any exchange of covered information for monetary consideration, which is materially wider than the pre-2021 rule focused on onward licensing or resale.[9][15]
  • Data brokers were brought directly into scope, and they must provide a designated method for consumers to opt out of sales of their information.[9][15]
  • The law took effect on 1 October 2021, with the current rule set reflecting that 2021 amendment rather than any later Nevada privacy overhaul.[8][9][14]
  • Nevada’s privacy law remains narrower than comprehensive state consumer privacy statutes; it is primarily an online notice-and-opt-out regime rather than a full access, correction, or deletion framework.[3][9][15]
  • Nevada law authorizes cure for a first failure to comply with certain requirements, which limits exposure for an initial violation if remedied after notice.[9][15]

What It Is

Nevada’s Privacy of Information Collected on the Internet from Consumers Act (NPICICA), as amended by SB 260, is a state online privacy law governing the collection and sale of covered information about Nevada residents by operators of websites or online services and by data brokers.[9][15] The amendment is part of Nevada’s internet privacy framework, not a general-purpose comprehensive privacy act.[9][15]

The amending bill was passed by the Nevada Legislature in May 2021, signed by the Governor in June 2021, and became effective on 1 October 2021.[8][9][14][15] The sources reviewed do not show a later 2025–2026 amendment that replaced SB 260; current summaries continue to describe 1 October 2021 as the operative effective date.[3][4][7][8]

Nevada’s enforcement mechanism sits in the state statutory framework for consumer privacy obligations, and the amendment itself expressly revises the definitions and compliance duties tied to operators, data brokers, and covered information.[9][15]

Who Must Comply

SB 260 primarily reaches businesses or commercial entities that own or operate a website or online service for commercial purposes, collect covered information from Nevada residents, and fall within Nevada’s statutory thresholds and targeting concepts.[1][2][4] Nevada-focused summaries consistently describe the law as aimed at online operators serving Nevada residents rather than all companies with any Nevada contact.[1][2][4]

The amendment also covers data brokers, defined in the statute as persons primarily engaged in purchasing covered information about consumers residing in Nevada from operators or other data brokers and then making sales of that information.[9][15] That is the most important expansion introduced by SB 260.[1][7][9][15]

The law is still limited by statutory exemptions. Reputable summaries identify exemptions for entities already regulated under certain federal privacy regimes, such as HIPAA and GLBA, and for consumer reporting agencies.[2][4] Those exemptions mean the Nevada rule does not duplicate federal sectoral privacy law where it already governs the information or entity.[2][4]

Extraterritorial reach is limited: the law is triggered by Nevada residents’ information and by the covered operator or data broker’s online activity, not by a broad “doing business in Nevada” test alone.[1][2][4]

Core Requirements

  1. Expanded definition of sale — SB 260 requires covered entities to treat an exchange of covered information for monetary consideration as a sale, even if the recipient is not intended to resell or license the information onward.[9][15]
  1. Consumer opt-out rights — Operators and data brokers must provide Nevada consumers a mechanism to direct that their covered information not be sold, and the business must honor that instruction within the statutory framework.[1][2][9][15]
  1. Data broker opt-out channel — Data brokers must maintain a designated address or comparable mechanism through which consumers can submit opt-out requests, making the right operational rather than merely notice-based.[9][15]
  1. Updated notices to website visitors — Covered operators must give notice describing the categories of covered information collected and the consumer’s opt-out right, with the amendment clarifying what the notice must cover.[1][2][4]
  1. Compliance with consumer instructions — If a consumer opts out, the operator or data broker must stop selling the relevant covered information to the extent the statute requires, subject to the law’s scope and exemptions.[1][2][9]
  1. Limited cure for first failure — The statute authorizes an operator or data broker to remedy a first failure to comply with certain requirements, which creates a cure pathway rather than immediate uncured liability in every case.[9][15]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | SB 260 passed by Nevada Legislature | 2021 | Legislative adoption of the amendment revising online privacy rules.[8][9][14] | | Governor signed SB 260 | June 2021 | Enactment into law after legislative passage.[8][9][14] | | SB 260 effective date | 1 October 2021 | New definitions, notice, sale, and opt-out obligations became operative.[3][4][8][9][15] |

Maximum fines and other sanctions are not set out in the sources reviewed in a way that provides a clean, single statewide civil-penalty number for SB 260 specifically. The operative statutory structure instead emphasizes compliance duties, notice, opt-out handling, and the ability to cure a first failure for certain violations.[9][15] Because of that, the most defensible statement is that violation exposure is governed by Nevada’s enforcement provisions and any applicable attorney general action or other statutory remedy, rather than a widely cited fixed per-violation ceiling in the amendment text itself.[9][15]

How to Comply

  1. Map data flows to Nevada residents — Identify whether your website, online service, or data brokerage activity collects covered information from Nevada residents and whether any exemptions apply.[1][2][4]
  1. Classify what you sell — Determine whether any transfer of covered information is an exchange for monetary consideration, because SB 260 broadened the definition of sale.[9][15]
  1. Update consumer notices — Refresh privacy notices so they describe the categories of covered information collected and the consumer’s right to opt out of sale, with a visible path for requests.[1][2][4]
  1. Build an opt-out intake process — Provide a functional email address, webform, or other designated channel for opt-out requests and ensure those requests are routed to suppression systems promptly.[9][15]
  1. Implement suppression controls — Maintain internal controls so opted-out information is not sold downstream, and document the workflow for vendors and affiliates that receive the data.[1][2][9]
  1. Use ISO 27001 for governance and evidence — Map Nevada privacy controls into an information security management system so notice, request handling, vendor oversight, and recordkeeping are auditable.
  1. Use NIST CSF 2.0 for operational control design — Align the program to identify data assets, protect request channels, detect unauthorized sharing, respond to opt-out failures, and recover from process breakdowns.
  1. Use ISO 42001 where AI systems consume personal data — If profiling or AI-enabled analytics use Nevada consumer data, extend governance to data minimization, purpose controls, and lifecycle accountability for the model pipeline.

Related Regulations

Nevada’s SB 260 overlaps with California CPRA because both create consumer-facing opt-out expectations around personal data sharing, but California is much broader in rights and enforcement structure. It intersects with the Virginia VCDPA and other comprehensive state privacy laws because those regimes add access, deletion, and appeal rights that Nevada’s law does not generally provide. It can conflict operationally with GLBA if a financial institution’s data flows are already governed by federal privacy rules, which is why sectoral exemptions matter. It also sits alongside HIPAA for health data, where federal health privacy rules generally preempt or displace overlapping state obligations for protected health information.[2][4] For data brokers, it resembles newer state broker-registration regimes, but Nevada’s focus is narrower: consumer opt-out of sales of covered information.[9][15]

FAQ

Does SB 260 apply to companies outside Nevada?

Yes, if the company operates a website or online service that collects covered information from Nevada residents and falls within the statute’s scope. The trigger is the handling of Nevada residents’ information, not incorporation in Nevada. That said, the law remains narrower than a general extraterritorial privacy statute.[1][2][4]

What counts as a sale under Nevada’s amended law?

SB 260 treats the exchange of covered information for monetary consideration as a sale. That is broader than a resale-only concept and can capture transfers where money changes hands even if the recipient does not intend to resell the data.[9][15]

Are data brokers covered now?

Yes. SB 260 expressly added data brokers to the compliance framework and requires them to provide a way for consumers to opt out of sales of their information. That was one of the amendment’s central changes.[1][7][9][15]

Does Nevada privacy law give access or deletion rights?

Not as a general matter under the SB 260 framework. The law is primarily about notice and opt-out of sale, rather than a full suite of rights such as access, correction, or deletion found in some other state privacy laws.[3][4][15]

Are there exemptions for regulated industries?

Yes. Reputable summaries identify exemptions for entities and information already covered by laws such as HIPAA and GLBA, along with consumer reporting agencies. Those exemptions reduce duplication where federal or other sector-specific privacy laws already govern the data.[2][4]

What happens if a company misses a requirement once?

The statute authorizes a cure for a first failure to comply with certain requirements, which can reduce immediate exposure if the issue is corrected. That does not eliminate ongoing compliance obligations or protect repeated violations.[9][15]

Sources

Put it into practice

More compliance guides