Does Nevada's Consumer Health Data Law Have a Revenue or Volume Threshold for Businesses?

No. Nevada's consumer health data law, enacted as SB 370 and effective March 31, 2024, applies to any "regulated entity" that conducts business in Nevada or produces products and services targeted to Nevada residents and handles consumer health data — with no minimum revenue figure or consumer-count threshold required to trigger coverage.

What Counts as a "Regulated Entity"

The law, codified in NRS 603A.400 through 603A.550, defines its scope broadly around the activity rather than the size of the business: collecting, processing, sharing, or selling consumer health data is enough to bring an entity into scope, regardless of annual revenue or how many Nevada residents' data is involved. That's a different design from most comprehensive state privacy laws, which typically exempt smaller businesses through a resident-count or revenue floor.

Why This Matters for Health and Wellness Advertisers

Businesses running paid campaigns for telehealth, fertility tracking, mental health, fitness, or wellness products often rely on audience targeting and geofencing tied to health-related behavior or location — exactly the kind of data this law was written to restrict. Because there's no size exemption, even a small clinic or app running its own Meta or Google campaigns can't assume it's too small to be covered the way it might reasonably assume for a broader state privacy law with a 25,000- or 100,000-consumer floor.

Don't Confuse This With Nevada's Separate Data Broker Law

Nevada has a second, older privacy statute — SB 260, effective October 1, 2021 — that requires data brokers specifically to honor consumer opt-out-of-sale requests. SB 260 and SB 370 are separate laws covering different conduct: SB 260 targets the sale of covered information by data brokers, while SB 370 targets the handling of consumer health data by any regulated entity. A business can be covered by one, both, or neither depending on what it does with Nevada residents' data, so treating them as the same requirement is a common and costly mistake.

Enforcement

• Attorney General only: Nevada's health data law is enforced exclusively by the Nevada Attorney General, with no private right of action for consumers to sue directly.
• No general cure period for repeat issues: Unlike SB 260's data broker provisions, which include a first-time cure opportunity, sources reviewing SB 370 don't describe an equivalent standing cure period for consumer health data violations.

Bottom Line

If your campaigns touch Nevada residents' health, fitness, or wellness data in any way, Nevada's SB 370 likely applies regardless of how small your business is — check what health data your pixels, CRMs, and ad audiences actually collect rather than relying on a size exemption that this particular law doesn't offer.

Sources: Nevada SB 370 (2023), codified at NRS 603A.400–603A.550; Nevada SB 260 (2021), codified at NRS 603A.323; Sheppard Mullin, "Nevada Privacy Law" overview (sheppard.com); Fortra, "Changes to Nevada's Privacy Law Include Requirements for Data Brokers" (fortra.com).