Nevada gives online shoppers a right that carries no revenue threshold with it. Any commercial website collecting information from Nevada residents has to maintain an address where a consumer can direct it not to sell that information, and it has sixty days to comply with the request. A one-person Nevada store with a checkout page is covered on the same terms as a national retailer, which is unusual.
NRS 603A.345 requires each operator to establish a designated request address through which a consumer may submit a verified request directing the operator not to make any sale of covered information it has collected or will collect about that consumer. An operator that receives such a request shall not make any sale of that information, and shall respond within sixty days, extendable by up to thirty more days where the operator determines an extension is reasonably necessary and notifies the consumer.
Who counts as an operator is set by NRS 603A.330. It is a person who owns or operates a website or online service for commercial purposes, collects and maintains covered information from consumers who reside in Nevada and use the site, and purposefully directs activities toward the state or otherwise has sufficient nexus with it. Pure third-party hosts and processors are excluded, as are entities covered by federal health privacy law and a person who does not collect, maintain or sell covered information.
There is no revenue floor and no minimum number of consumers. That is what separates the Nevada rule from the better-known California framework, and it is why small Nevada sellers are in scope.
One thing Nevada does not have is a posted refund policy rule. Several states require a store to display a restrictive return policy or lose the benefit of it. We checked Nevada’s trade regulation chapter and found no equivalent, so in a Nevada shop the written policy on the receipt is what governs.
Nevada leaves returns to the merchant and regulates the data instead. That inverts the usual checklist: read the return terms carefully because nothing backs you up, and know that the privacy request channel does exist because the statute requires it.
General information only, not legal advice. NRS 603A has been amended more than once since it was enacted and local licensing adds requirements of its own, so confirm current obligations with the Nevada Attorney General’s office or the Secretary of State before relying on this page.
Yes. NRS 603A.345 requires every operator to maintain a designated request address, and lets a consumer submit a verified request directing the operator not to sell covered information it has collected or will collect. The operator must not sell that information and must respond within sixty days, with one extension of up to thirty days if it notifies you.
No, and that is the unusual part. NRS 603A.330 defines an operator by conduct rather than size: owning or operating a website for commercial purposes, collecting covered information from Nevada residents who use it, and purposefully directing activities toward the state. There is no revenue floor and no minimum consumer count.
We found no such requirement in Nevada's trade regulation chapter. Some states make a retailer display a restrictive refund policy or lose the benefit of it. Nevada does not appear to, so read the store's own written policy before you buy and keep the receipt.
NRS 603A.330 excludes third parties that only host or process a site on someone else's behalf, entities covered by federal health privacy law, certain motor vehicle data, and anyone who does not collect, maintain or sell covered information at all.