HB2953 would create a new West Virginia consumer data privacy article governing how covered businesses collect, use, disclose, and retain personal information. The bill defines a broad range of covered data, including identifiers, browsing and geolocation data, biometric information, health-related information, and inferences drawn from consumer data. It requires businesses to publish and update privacy policies, notify consumers at or before collection about what data is gathered and why, and limit retention of personal information to the period necessary for the original purpose, a contract term, or one year after the consumer’s last interaction, whichever comes first.
The bill gives consumers several enforceable rights over their data, including the right to request access to personal information, obtain a copy in a portable format, delete personal information, correct inaccurate information, and learn what categories of data were sold, shared, or disclosed for business purposes. It also creates a right to opt out of the sale or sharing of personal information, requires businesses to provide a “Do Not Sell or Share My Personal Information” link, and imposes special opt-in protections for minors. Businesses may not discriminate against consumers for exercising these rights, and they must provide accessible methods for submitting requests without requiring an account.
HB2953 would also regulate contracts with service providers and third parties by restricting how they may use, retain, combine, or resell consumer data, and it would require downstream subcontractors to be bound by similar obligations. The bill authorizes the West Virginia Division of Consumer Protection to adopt rules, investigate violations, and seek civil penalties, while also creating a private cause of action for certain unauthorized access incidents involving nonencrypted, nonredacted personal information or login credentials. Remedies include statutory damages, actual damages, and injunctive or declaratory relief.
The bill’s overall impact would be to significantly expand state privacy obligations for businesses operating in West Virginia, especially larger companies and entities that collect or monetize consumer data. It would align West Virginia more closely with states that have comprehensive consumer privacy laws by establishing notice, access, deletion, correction, opt-out, and anti-discrimination requirements, along with enforcement through both state action and private litigation.
There is no recorded committee transcript or vote history in the provided materials, so no formal legislative debate or recorded sentiment is available. Based on the bill text alone, the measure appears designed as a consumer-protection bill with a strong privacy-rights orientation, but it also imposes substantial compliance and enforcement burdens on covered businesses, which are the most likely source of opposition or concern.
The bill would add a new Article 9 to Chapter 46A of the West Virginia Code, creating a comprehensive consumer data privacy framework. It would impose privacy-policy, notice, retention, access, deletion, correction, opt-out, and anti-discrimination requirements on covered businesses, while also regulating service providers, third parties, and subcontractors that receive consumer data. It further authorizes rulemaking and enforcement by the West Virginia Division of Consumer Protection and creates a private right of action for certain data security violations, thereby expanding both administrative and civil liability exposure for businesses handling personal information.
No committee discussion or vote record was provided, so there is no documented legislative sentiment from hearings or floor action. From the bill’s structure and stated purpose, the measure is framed as a consumer privacy and data-protection bill intended to give residents stronger control over personal information. The likely general support would come from consumer privacy advocates and supporters of stronger data rights, while businesses, advertisers, data brokers, and other entities that rely on data collection or targeted advertising may view it as burdensome or costly to implement.
The main points of contention are likely to be the scope of covered businesses, the breadth of the definition of personal information, and the operational burden of compliance. Businesses may object to the opt-out/opt-in rules for sale or sharing, the required homepage disclosures, retention limits, and the obligation to honor access, deletion, and correction requests within set timeframes. Another likely flashpoint is enforcement: the bill allows both state enforcement and private lawsuits, which increases litigation risk. The strongest consumer-side concerns would likely focus on whether the bill’s exceptions for business purposes, service providers, research, and internal uses are broad enough to preserve meaningful privacy protections.