Consumer Data Protection Act
HB5123, titled the Consumer Data Protection Act, would create a new article in West Virginia law establishing a comprehensive consumer privacy framework for businesses that collect personal information from state residents. The bill defines covered businesses and a wide range of protected data, including identifiers, browsing and location data, biometric information, health-related information, and inferences drawn from that data. It requires covered businesses to maintain an online privacy policy, disclose what categories of data they collect, sell, share, or disclose for business purposes, and tell consumers what privacy rights are available.
The bill gives consumers several enforceable rights over their personal information. These include the right to request a copy of data collected about them, the right to delete or correct certain information, the right to learn what data was sold or shared and to whom, and the right to opt out of the sale or sharing of personal information. It also restricts businesses from discriminating against consumers who exercise these rights, requires accessible request procedures and a “Do Not Sell or Share My Personal Information” link, and limits how long businesses may retain personal data. The bill further imposes special protections for minors and sets rules for contracts with service providers, third parties, and subcontractors.
If enacted, HB5123 would add a new consumer privacy article to the West Virginia Code and impose significant compliance obligations on covered businesses operating in the state. It would require privacy notices, data-access and deletion procedures, opt-out mechanisms, retention limits, contractual restrictions on data sharing, and age-based limits on selling or sharing minors’ data. The bill also authorizes the West Virginia Division of Consumer Protection to adopt rules, investigate violations, seek civil penalties, and bring enforcement actions, while creating a private right of action for certain data breaches involving unauthorized access to sensitive credentials.
Based on the bill text and the absence of recorded committee testimony or votes in the provided materials, the overall sentiment appears to be strongly pro-consumer and privacy-focused. The bill’s stated purpose is to protect consumer data privacy, and its structure mirrors modern state privacy laws that are generally framed as consumer-rights legislation. No opposing or supporting remarks are available in the provided context, so there is no recorded legislative debate to indicate broader support or resistance.
The main points of potential contention are likely to be the scope of covered businesses, the breadth of the personal information definition, and the compliance and enforcement burden on businesses. Businesses may object to the operational costs of privacy notices, request-response systems, opt-out links, retention schedules, and contract revisions, while consumer advocates would likely support those requirements as necessary protections. Another likely issue is the private cause of action and the civil penalties authorized for violations, which could be viewed as strong enforcement tools by supporters but as exposure to litigation and regulatory risk by opponents. The bill also contains heightened protections for minors and restrictions on data sharing and advertising uses, which may be especially sensitive for digital advertising and data brokerage interests.