language: en · status: in-force · last checked: 2026-10-08

Nevada — school service providers (NRS 388.281 to 388.296)

Nevada's operator statute, the "School Service Providers" subheading of the part of NRS chapter 388 on the privacy of data concerning pupils. Enacted by 2015 Statutes of Nevada, chapter 333 (SB 463), which "becomes effective on July 1, 2015" (section 14 of the act), and amended in 2017 and 2019, it binds the school service provider — the operator of a website, online service or mobile application used primarily for educational purposes in Nevada public schools — directly: a written disclosure before use, limits on collecting, using and transferring pupil information, deletion on request, a security plan and breach notice, and a civil penalty enforced by the Attorney General. Contractual waivers are void.

Applicability to EdTech

• Who is caught. A "school service" is an Internet website, online service or mobile application that collects or maintains personally identifiable information concerning a pupil, is used primarily for educational purposes, and is designed and marketed for use in public schools and used at the direction of teachers (NRS 388.283(1)). General-audience services are out, and so is a service whose provider has been designated a FERPA school official, has contracted with the district and has agreed to be bound by FERPA (NRS 388.283(2)(c)), and so are "any instructional programs purchased by" a district, charter school or the Department (NRS 388.283(2)(e)). Whether a paid district licence takes a product out of the statute turns on those exclusions, so read them against the contract in hand.
• Disclosure before first use. Before the board of trustees and each teacher begin using the service, the provider must give them a written, easy-to-understand disclosure of the PII it collects, how it is used and a description of its data security plan, and must give notice before any material change to that plan (NRS 388.291(1)–(3)). Pupils aged 18+ and parents must be able to review the PII, with a correction process (NRS 388.291(4)).
• Purpose limitation and onward transfer. Collection, use, access and transfer are allowed only for the listed purposes, chiefly those inherent to classroom use or authorised by the board (NRS 388.292(1)). Transfer to a third-party service provider (a sub-processor) requires notice and a contract binding it to the same limits and to NRS 388.281–388.296 (NRS 388.292(2)).
• Deletion within 30 days of a request from the board or governing body, and on a parent's request where no policy exists (NRS 388.292(3)).
• Prohibitions: targeted advertising, sale (save to an acquirer that becomes bound), profiling not related to instruction without consent, use inconsistent with the contract, and knowing retention beyond the contract period (NRS 388.292(5)). Adaptive learning, improving the service, recommendations and feedback stay permitted (NRS 388.292(6)).
• Civil penalty of up to $5,000 per violation, recovered by the Attorney General (NRS 388.292(7)).
• Security plan and breach notice. The provider must establish and carry out a detailed security plan with administrative, technological and physical safeguards (NRS 388.293(1)), bind any successor before it gets access (NRS 388.293(2)), and notify the school "as soon as practicable and without unreasonable delay" of a breach (NRS 388.293(3), defined in (5)).
• Schools publish a provider list. Before pupils use any school service or technology, each public school must post a summary of these laws, a list of its school service providers and confirmation that each has a security plan (NRS 388.2955(1)). A provider should expect to be named on that page and asked for evidence of the plan.
• No contracting out. A contract term that waives or conflicts with any of these sections is void (NRS 388.296).

Contents

Key obligations at a glance

• Written disclosure of PII types, uses and security plan before use; notice of material plan changes — NRS 388.291.
• Use and transfer only for permitted purposes; bind sub-processors by contract — NRS 388.292(1)–(2).
• Delete within 30 days of a school's request — NRS 388.292(3).
• No targeted advertising, sale or non-instructional profiling — NRS 388.292(5).
• Security plan, successor undertaking and breach notice — NRS 388.293.

Enforcement

A civil penalty not exceeding $5,000 per violation of NRS 388.292, recoverable by the Attorney General in a civil action in the name of the State (NRS 388.292(7)).

Licence

The corpus reproduces NRS 388.281 to 388.296 verbatim from the Legislative Counsel Bureau's HTML of NRS chapter 388. The chapter page carries no copyright notice (checked in full), and NRS chapter 220, which governs the publication of the Nevada Revised Statutes, contains no copyright provision (NRS chapter 220, read 2026-10-08 through the Internet Archive capture of 14 November 2025).

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection." The SourceNote credits are the Legislative Counsel Bureau's, made in the course of its legislative duties, which is the situation that holding covers.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, whitespace collapsed, nothing reworded).

Related

• Nevada pupil-data duties of state and local entities (NRS 388.267–388.278) — the first half of the same part, including the required contract provisions of NRS 388.272
• California SOPIPA — the operator-binding model Nevada adapted
• FERPA — the federal definition of personally identifiable information that NRS 388.282 adopts

Sources

• Nevada Legislature — NRS chapter 388 (read through the Internet Archive capture of 6 October 2026; see the fact document)
• 2015 Statutes of Nevada, chapter 333 (SB 463) — the enacting act