Efforts in Congress to pass an online privacy law appear to have stalled, but some states have taken matters into their own hands.
Ahead of the comprehensive California Consumer Privacy Act taking effect in January of next year, a law in Nevada began to address online privacy in October, requiring websites and other online services to tell consumers how they collect and use personal data and to allow them to opt out of such collection.
The Nevada law, an amendment to existing privacy regulations in the state, is more limited than the CCPA. It requires websites and online services to provide an address where consumers can ask to opt out of data collection. The sites must then honor the request within 60 days, with a 30-day extension when a website can plausibly claim the delay is “reasonably necessary.”
The Nevada law does not allow consumer privacy lawsuits but allows the state attorney general to seek civil penalties of up to $5,000 per violation.
Privacy lawyers and other legal experts gave the Nevada law mixed reviews, with some saying the legislation gives consumers more control over their data. Critics say the law is limited in scope and offers fewer consumer protections than the California privacy law.
“Any step toward greater data protection is positive for consumers in the long term, but the Nevada law does little on its own to protect them,” said Simon Fogg, a data privacy expert and legal analyst for compliance solution vendor Termly. “Overall, it’s less strict than the CCPA — more entities are exempt, plus the definition of personal data is narrower.”
Unlike the CCPA, the Nevada law does not require businesses to include a “do not sell my information” link in a conspicuous spot on their websites, Fogg noted.
“Ultimately, the CCPA already set the precedent for consumer data rights under state privacy laws — and the Nevada law fails to meet that standard,” he added. “The privacy law creates another hoop for companies to jump through but doesn’t signal to consumers that the Nevada legal system truly understands the value of their personal information.”
Still, the Nevada law in itself shouldn’t create significant compliance headaches for most businesses given that CCPA compliance is on the horizon, Fogg and other experts said. “However, although organizations with large legal budgets likely won’t encounter any problems, smaller companies may be confused by the differences in the two laws regarding how consumers opt out,” he added.
The compliance concerns for small businesses come as more states and other countries push for new privacy laws, Fogg added. “With the influx of data privacy laws around the world, small business owners may feel like they’re navigating a minefield,” he said.
Maine also passed a privacy law this year, this one targeting broadband providers. The law, which goes into effect in July, prohibits broadband providers, in most cases, from using, selling, or giving access to customer personal information unless the customer gives permission.
In the case of the Nevada law, many businesses will focus on complying with the CCPA, experts said.
“Since most significant businesses operating in Nevada already have major operations in California, the new Nevada statute likely will not have a significant impact on business,” said Stephen J. Newman, a partner in the Stroock & Stroock & Lavan law firm in Los Angeles. “I would be very surprised if the Nevada attorney general did not accept a business’s compliance with California’s law as sufficient under the Nevada law.”
The effectiveness of the Nevada law depends on enforcement efforts, said Joseph P. McClelland, a consumer protection lawyer from the Atlanta area.
“Whether or not this law is useful to the residents of Nevada all depends on the attorney general,” he said.
Because no federal privacy law is available, states “must act” to protect their residents from online data collection, he added.
Chris Olson, CEO of web privacy and security vendor The Media Trust, praised the Nevada effort as a complement to the CCPA. The Nevada law “gives consumers a choice over what companies can do with their personal information,” he said. “Consumers want choice and transparency. Together, these two laws give them both.”
