Nevada's Consumer Health Data Law (SB 370)

Who SB 370 applies to

SB 370 reaches "regulated entities" — broadly, businesses that conduct business in Nevada or target products and services to Nevada consumers, and that determine how and why consumer health data is processed. Like Washington's law, applicability follows the consumer rather than your office location, so a company with no Nevada presence can still be in scope by serving Nevada residents. There is no general small-business carve-out based on revenue or headcount, though data already regulated under HIPAA and certain other federal frameworks is excluded.

What counts as consumer health data in Nevada

Nevada's definition covers information that is linked or reasonably linkable to a consumer and that identifies their past, present or future health status. In practice this includes conditions and diagnoses, treatments and medications, bodily functions and vital signs, reproductive and sexual health information, gender-affirming care, biometric data used for health purposes, precise location that could indicate an attempt to obtain health services, and — importantly — inferences drawn from non-health data. Buying patterns that imply a condition can create regulated data even if the consumer never disclosed anything medical.

The core obligations

• A consumer health data privacy notice — a distinct notice, separately linked, disclosing the categories collected, the purposes, the categories of third parties receiving it, and how consumers exercise their rights.
• Opt-in consent before collecting or sharing — consent must be freely given, specific and unbundled from general terms acceptance. Dark patterns don't produce valid consent.
• A separate written authorization before selling — a consent to collect and share does not cover selling. The authorization must identify the purchaser and the purpose, and be revocable.
• Consumer rights — the right to confirm whether you're processing their health data, to access it, and to request deletion, with a defined response window.
• A geofencing prohibition — you may not establish a virtual boundary within 1,750 feet of a health care facility to identify, track, collect data from, or send health-related advertising to consumers. This is a flat ban; consent doesn't cure it. See our geofencing explainer for how these provisions work in practice.

How enforcement differs from Washington

This is the difference that matters most commercially. Washington's act is generally understood to be actionable by individual consumers through the state Consumer Protection Act, which is why the first significant case arrived as a private class action. Nevada took the more conventional route: SB 370 is enforced by the Nevada Attorney General under the state's deceptive trade practices provisions, with no private right of action.

That materially lowers class-action exposure in Nevada — but it doesn't make compliance optional, and it doesn't help you at all in Washington. If you serve consumers in both states, your Washington exposure is the one that should drive your timeline.

A practical approach for multi-state businesses

Because the two statutes share a structure — notice, opt-in consent, separate sale authorization, rights process, geofencing ban — most businesses find it impractical to run two entirely separate programs. The common pattern is to build to Washington's standard first, since it is broadly the stricter of the two and carries private-litigation risk, then have counsel confirm whether the same notices and consent flows satisfy Nevada's specific wording or need a Nevada-specific addendum. What you should not assume is that satisfying one automatically satisfies the other; the definitions and notice requirements are similar, not identical.