Nevada consumer health data law (SB 370) for advertisers: consents, sales, geofencing and enforcement

What the statute says. A regulated entity is any person who conducts business in Nevada or targets products or services to Nevada consumers. It must also decide the purpose and means of processing, sharing or selling consumer health data (NRS 603A.465). There is no revenue or volume threshold and no small-business tier.

The protected person is narrower than in Washington. A consumer must have requested a product or service from the regulated entity (NRS 603A.425). An ad network or data broker that has no direct relationship with the person may sit outside that definition. Nothing in the text resolves the point, so it goes to counsel below.

The exemptions are entity-level for some sectors. The chapter excludes any person subject to HIPAA, financial institutions subject to GLBA and their affiliates, holders of nonrestricted gaming licenses and their affiliates, and data de-identified under 45 CFR 164.514 (NRS 603A.490). A hospital system or health plan is therefore outside Nevada's law altogether. Its marketing rules come from HIPAA; see the HIPAA marketing rule.

What commentators have said. The Future of Privacy Forum reads these choices as a "narrower, use-based" scope that covers fewer organizations than Washington's act (FPF, 22 June 2023).

Each row is a textual difference that can change an advertising plan. The Washington column summarises RCW 19.373 for comparison only.

What the statute says. A regulated entity may collect consumer health data only with the consumer's "affirmative, voluntary consent", or to the extent necessary for a product or service the consumer requested (NRS 603A.500(1)). Sharing needs a second consent, "separate and distinct" from the first, or necessity, or a legal requirement or authorization (603A.500(2)). Each request must state the data categories, the purpose and use, the categories of recipients and how to withdraw (603A.500(3)).

"Share" means to release, disclose or make available consumer health data by any means (NRS 603A.480). Unlike Washington's definition, it carries no express carve-out for processors. Processors still need a contract that sets processing instructions, and one that goes beyond it is treated as a regulated entity for that data (NRS 603A.530).

The privacy policy speaks to ad tracking. The policy must say "whether a third party may collect consumer health data over time and across different Internet websites or online services" when people use the entity's sites (NRS 603A.495(1)(j)). Adding new categories, recipients or purposes later needs fresh affirmative consent (603A.495(3)).

An example. A Nevada user signs up for a weight-loss app and enters a target weight and a medication. The app wants to upload a hashed email list of such users to a social platform for a lookalike audience. Under 603A.500, the upload is sharing. It needs the second consent, unless the platform is only the app's contracted processor for a purpose the user already agreed to.

What practitioners do (practice, not law). Teams that run one consent flow for Washington and Nevada often use Washington's stricter wording, then add Nevada's cross-site tracking statement to the health data policy.

What the statute says. No person may sell or offer to sell consumer health data without the consumer's written authorization, or beyond its scope (NRS 603A.535(1)). Service cannot be conditioned on signing it (603A.535(2)). The form must be in plain language and list the seller, the buyer, the specific data, the purpose and the buyer's intended use. It must also state the no-conditioning rule, the right to revoke and the risk of onward disclosure, and it must carry the expiry date and the consumer's signature (603A.535(3)).

The authorization expires one year after it is given (603A.535(5)). The seller gives copies to the consumer and to the buyer. Both keep a copy for at least six years after it expires (603A.535(7)-(8)).

What "sell" leaves out. The definition excludes exchanges with an affiliate, with a processor acting within the disclosed purpose, and with a third party to provide a product the consumer requested (NRS 603A.475). Licensing a health segment to an unrelated advertiser, or feeding third-party data marketplaces, fits none of those exclusions on the face of the text.

What the statute says. No person may implement a geofence within 1,750 feet of a medical facility, a facility for the dependent, or "any other person or entity that provides in-person health care services or products" (NRS 603A.540(1)). The ban applies when the geofence is used to identify or track people seeking in-person care, to collect consumer health data, or to send notifications, messages or ads related to their health data or care.

"Medical facility" and "facility for the dependent" take their meanings from NRS 449.0151 and 449.0045 (603A.540(2)). The section addresses "a person", not only regulated entities. Its text contains no consent exception, and the HIPAA exemption in 603A.490 removes HIPAA-covered persons from the whole chapter, including this section.

What practitioners do (practice, not law). Location buyers commonly draw a 1,750-foot exclusion around Nevada clinics, pharmacies and labs in their DSP. Some extend it to Washington's 2,000 feet everywhere so that one list serves both states.

A consumer may ask a regulated entity to confirm whether it collects, shares or sells the consumer's health data. The consumer may also ask for a list of every third party that received it, ask the entity to stop, and ask for deletion (NRS 603A.505). Responses are due within 45 days of authentication, with one 45-day extension (603A.510).

Deletion is faster. The entity must delete within 30 days and notify every affiliate, processor, contractor and third party that received the data. Each recipient then has 30 days to delete (NRS 603A.515). For an advertiser, that list of recipients includes ad platforms, measurement vendors and clean-room partners.

What the statute says. A violation "constitutes a deceptive trade practice" for the purposes of NRS 598.0903 to 598.0999. The chapter does "not create a private right of action" (NRS 603A.550). A processor that strays outside its contract is not guilty of a deceptive trade practice for that reason alone, but becomes a regulated entity for that data (603A.530(3)).

The penalty provisions. In an action under the deceptive trade practices statutes, a court that finds a willful violation may impose up to $15,000 per violation. Breaking a court order or injunction carries up to $10,000 per violation (NRS 598.0999(1)-(2)). Those subsections name the Commissioner of Consumer Affairs, the Director, district attorneys and the Attorney General as the officials who bring such actions.

What enforcers have done. We found no public enforcement action under NRS 603A.400 to 603A.550 as of 9 November 2026. Several law-firm summaries describe the Attorney General as the sole enforcer and cite lower penalty figures. The statute text above is broader and higher, so the point is listed for counsel.

The architectures that keep health signals out of third-party media are compared in programmatic advertising under HIPAA. Maryland goes further than Nevada and bans the sale of sensitive data outright; see Maryland's MODPA sensitive data rules. The ad tech compliance hub links the other state and federal pages.

1. Nevada Legislature, NRS Chapter 603A, Security and Privacy of Personal Information, sections 603A.400 to 603A.550 (revision dated 15 April 2026), checked 9 November 2026. https://www.leg.state.nv.us/nrs/NRS-603A.html
2. Nevada Legislature, NRS Chapter 598, Deceptive Trade Practices, section 598.0999, checked 9 November 2026. https://www.leg.state.nv.us/nrs/NRS-598.html
3. Future of Privacy Forum, "(Health) Data is What (Health) Data Does in Nevada" (22 June 2023). https://fpf.org/blog/health-data-is-what-health-data-does-in-nevada/
4. Washington State Legislature, RCW 19.373.010, Definitions (for comparison). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010
5. Washington State Legislature, RCW 19.373.040, Consumer rights and requests (for comparison). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.040
6. Washington State Legislature, RCW 19.373.090, Application of consumer protection act (for comparison). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090
7. Washington State Legislature, RCW 19.373.100, Exemptions (for comparison). https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100