Nevada and California Consumers Granted the Right to Opt-Out of the Sale of Personal Information
On May 29th, Nevada Governor signed Senate Bill 220, a new privacy law granting consumers the right to opt out of the sale of their personal information. Nevada is the second state to grant this right, following California (CCPA). SB 220 went into effect on October 1, 2019.
SB 220 and CCPA: Do Not Sell Provisions Notable Differences
Sale is Defined More Narrowly
SB 220 defines “sale” as the sale or licensing of personal information for monetary consideration.
CCPA defines “sale” more broadly as the sale, renting, release, disclosure, dissemination, availability, or transfer of personal information for monetary or other valuable consideration.
Consumer is Defined More Narrowly to Exclude Employee Information
SB 220 defines “consumer” as any person who seeks or acquires any good, service, money or credit for personal, family, or household purposes.
As currently written, CCPA defines consumer as California residents. (However, see AB 25, an amendment to exclude employee data from CCPA’s scope.)
The Personal Information Definition Excludes Household Information
Personal information in SB 220 is defined as personally identifiable information about a consumer.
CCPA defines personal information as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be associated with a consumer or household.
Broad Applicability – No Minimum Thresholds
CCPA will apply only to businesses that:
(1) have an annual gross revenue exceeding $25 million;
(2) annually buys, receives, sells, or shares for commercial purposes the personal information of 50,000 or more consumers, households, or devices; and/or
(3) derives 50 percent or more of its revenue from selling consumers’ personal information.
Unlike the CCPA, Nevada’s privacy law will not have minimum thresholds that must be met for the law to apply.
SB 220 will apply to businesses that:
(1) own or operate a website or online service;
(2) collect personal information from consumers who reside in the state and use or visit the site; and
(3) direct their activities toward the state, purposefully avail itself of the privilege of conducting activities in the state, or otherwise have a sufficient nexus with the state.
Longer Time to Respond
Like CCPA, SB 220 requires that businesses respond to verifiable requests within a defined time. SB 220 requires that businesses respond within 60 days upon receiving a request; with a 30 day extension permissible if necessary.
CCPA requires that requests be responded to within 45 days of receiving of request; with a 45 day extension permissible if necessary.
Businesses Can’t Request Authorization for Sale After Opt Out
CCPA expressly provides that businesses can, after 12-months of respecting a consumer’s decision to opt-out, request from the consumer authorization for the sale of his or her personal information.
SB 220 does not provide businesses a similar right. Rather, it requires the businesses that receive opt-out request not make any sale, indefinitely.
Conspicuous “Do Not Sell My Personal Information” Link Not Required
CCPA expressly requires that business provide a clear and conspicuous link on the business’s internet homepage, titled “Do Not Sell My Personal Information,” for individuals to make a request.
SB 220 requires that businesses have a designated request address—email address, telephone number, website—for individuals to submit requests. There is no requirement for the request address to be on a business’s internet homepage.
Maintain a Compliant Data Driven Advertising Ecosystem
Learn more about CCPA and Nevada Privacy Law Cookie Consent requirements. Experts have answered over 25 questions to help marketers, website publishers, and privacy teams comply with CCPA and SB 220.