Nevada and Maine recently passed data privacy bills that protect data subjects from having their data sold without their consent.

The Nevada bill was signed into law May 29, and it grants consumers the right to opt out of the sale of their personal information. The act, which amends an existing online privacy notice law, is significantly narrower than the California Consumer Privacy Act (CCPA). It applies only to online activities, defines “consumer” and “sale” in a much more limited manner than the CCPA, and includes broad exceptions for financial institutions subject to the Gramm-Leach-Bliley Act, entities subject to the Health Insurance Portability and Accountability Act, and vehicle manufacturers and vehicle service and repair entities that collect covered information from vehicles through connected or subscription services.