Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Nevada consumer health data law

In force Nevada · In force Mar 31, 2024 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectMar 31, 2024 · 2.6 years ago · Source
Takes effectSection 36: act effective March 31, 2024.
MilestoneJun 16, 2023 · 3.4 years ago · Source
Approved by GovernorChapter 525, Statutes of Nevada 2023.

Summaries for reference, not legal advice. Check the official text.

What it does

Washington-style consumer health data law. Regulated entities need consent to collect and share consumer health data, must publish a health data privacy policy, honor access and deletion rights, and cannot geofence health care facilities. Selling consumer health data needs written authorization.

Who it applies to
Persons doing business in Nevada or targeting Nevada consumers that determine how consumer health data is processed; HIPAA and GLBA data and some small entities are excluded.
Penalties
Deceptive trade practice; AG may seek civil penalties. No private right of action.
Enforced by
Nevada Attorney General
Official name
Nevada Consumer Health Data Privacy Law (SB 370)
Citation
Stats. 2023, ch. 525; NRS 603A.400 to 603A.550
Topics
Health data, Privacy, Biometrics
Verified 2026-09-25 leg.state.nv.us leg.state.nv.us
Research notes

Complements us-wa-mhmda.

Related

EnactedAlabama
Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months
In forceArkansas
Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026
AmendedCalifornia
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
In forceCalifornia
California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026
In forceCalifornia
California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months
EnactedCalifornia
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months
In forceCalifornia
California social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026
EnactedColorado
Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months
Questions about Nevada consumer health data law
What are the Nevada consumer health data law compliance deadlines?
Jun 16, 2023: Approved by Governor. Mar 31, 2024: Takes effect.
When does Nevada consumer health data law take effect?
Nevada consumer health data law took effect on Mar 31, 2024.
Who does Nevada consumer health data law apply to?
Persons doing business in Nevada or targeting Nevada consumers that determine how consumer health data is processed; HIPAA and GLBA data and some small entities are excluded.
What are the penalties under Nevada consumer health data law?
Deceptive trade practice; AG may seek civil penalties. No private right of action.