Chapter 603A of the Nevada Revised Statutes (NRS) - "SECURITY AND PRIVACY OF PERSONAL INFORMATION" - described different rule sets with different consequences (enforcement and fines) for different actors.
Collector: Governmental agency, institution of higher education or any type of business that for any purpose, whether by automated collection or otherwise, handles, collects, disseminates or otherwise deals with nonpublic personal information. Collectors are in scope for NRS 603A.010-603A.300, which focuses on IT security.
Operator: Owns or operates an internet website for online services or commercial purposes. Collects and maintains covered information from consumers who reside in Nevada. Purposefully directs its activities toward this State, consummates some transaction with this State or a resident thereof or purposefully conducts activities in this State [ADDED BY SB-220] or otherwise engages in any activity that constitutes sufficient nexus with this State to satisfy the requirements of the United States Constitution. Excluded from the term "operator" are:
Service providers ("a third party that operates, hosts or manages an Internet website or online service on behalf of its owner or processes information on behalf of the owner of an Internet website or online service") are excluded.
[ADDED BY SB-220] Financial institution subject to Gramm-Leach-Bliley Act
[ADDED BY SB-220] entity that is subject to health Insurance Portability and Accountability act
[ADDED BY SB-220] Manufacturers of motor vehicles or persons who repair motors and collect, generate, record or store info that is retrieved from a motor vehicle in connection with the service related to it or that was provided by the consumer in connection with a registration for a technology or service related to the vehicle
Some operators are exempt from the notice obligations: If their revenue is primarily derived from another source than selling on a website and if they have fewer than 20,000 unique visitors per year. Operators are in scope for NRS 603A.300 -603A.360, which describes the notice rights of consumers and - with the SB-220 amendment - includes a right to opt out of the sale of data.
It is possible to only be a collector, only be an operator, or to be a collector which is also an operator.