HB 2987 West Virginia House of Delegates · 2025 Regular Session

Relating to the Consumer Data Protection Act

HB 2987, titled "Relating to the Consumer Data Protection Act," creates a "safe harbor" for businesses that implement written cybersecurity programs meeting specific standards. It directly affects businesses processing personal data for at least 100,000 consumers or deriving over 50% revenue from selling data for 25,000+ consumers, shielding them from punitive damages in data breach lawsuits if they maintain required administrative, technical, and physical security measures. The bill also grants consumers rights to access, correct, delete their personal data, and opt out of targeted advertising, while exempting government entities and providing limited immunity for universities offering cybersecurity programs. It establishes enforcement by the Attorney General and defines key terms like "personal information" and "data breach" to clarify scope.

Issues: ✓ Technology

Bill status passed 3 of 5 stages cleared

Introduction

Feb 2025

Committee Review

Mar 2025

House of Delegates Passage

Mar 2025

Senate Passage

Governor

Introduced Feb 26, 2025 Last action Mar 27, 2025

Maddy AI version diff · 2 comparisons

What changed between versions

Committee Substitute → Engrossed Committee Substitute · 3 edits · Mar 26, 2025

MINOR

The bill was updated from a 'Committee Substitute' to an 'Engrossed Version,' indicating it has passed further review and is ready for final legislative action. The text includes minor formatting corrections and clarifications to definitions, such as adding specific requirements for how de-identified data must be handled and adjusting the punctuation for consumer data disclosure exceptions. These changes refine the legal language to ensure clearer compliance standards without altering the core policy intent.

Scope change

The scope and applicability of the bill remain unchanged; the updates are primarily technical refinements to the text.

DEFINITION

Clarified the definition of 'de-identified data' by adding specific conditions regarding reasonable measures, public commitment, and contractual obligations to prevent re-identification.

REQUIREMENT

Corrected punctuation in the list of exceptions for consumer data disclosure to improve readability and legal precision.

TECHNICAL

Updated the document header to reflect the current status as the 'Engrossed Version' and removed previous version labels.

Introduced Version → Committee Substitute · 9 edits

MAJOR

The bill was amended to add a new 'Safe Harbor' provision that allows businesses to avoid punitive damages if they follow industry-standard cybersecurity frameworks, while also expanding the scope of the Consumer Data Protection Act to include new definitions and stricter requirements for data brokers. The effective date for the law was delayed from January 1, 2026, to July 1, 2026, giving companies more time to prepare compliance measures.

Scope change

The bill's scope was expanded to include a new article on cybersecurity programs and immunity for institutions of higher education offering cybersecurity assessments. Applicability thresholds for the Consumer Data Protection Act were modified to include businesses with over $25 million in annual state revenue.

REQUIREMENT

Added a new affirmative defense allowing businesses to avoid exemplary or punitive damages if they maintain a written cybersecurity program conforming to industry standards.

Modified the definition of 'Sale of personal data' to exclude disclosures where the consumer directs the controller to share data or intentionally uses the controller to interact with a third party.

Changed the opt-out requirement for profiling to apply only to 'solely automated decisions' rather than all profiling activities.

Removed the requirement for data brokers to register annually with the Attorney General and pay a $100 registration fee.

DEFINITION

Redefined 'Personal information' to include 'precise location data' and expanded 'Nonprofit organization' to include specific fraud detection entities.

ELIGIBILITY

Added a new eligibility criterion for the Consumer Data Protection Act covering businesses with annual gross revenues in the state exceeding $25,000,000.

ENFORCEMENT

Increased the notice period for the Attorney General to initiate civil penalty actions from 30 days to 60 days.

TIMELINE

Delayed the effective date of the Consumer Data Protection Act from January 1, 2026, to July 1, 2026.

FISCAL

Clarified that the Consumer Privacy Fund will be used to support the Attorney General's enforcement work, subject to appropriation.

Floor votes · House of Delegates Mar 26, 2025

How they voted

94–1

Passed · 5 other

Total votes 100

Mar 26, 2025

D Democratic9

9 Yea

100% Yea

R Republican91

85 Yea 1 Nay 5

93% Yea

Vote distribution

All Yea All Nay Mixed No data

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Mar 27, 2025

Committee

To Judiciary

upper

Mar 27, 2025

Committee

To Judiciary then Finance

upper

Mar 27, 2025

Introduced

Introduced in Senate

upper

Mar 26, 2025

Lower · Passed

Passed House (Roll No. 194)

lower

Mar 21, 2025

Lower · Passed

By substitute, do pass

lower

Feb 26, 2025

Committee

To House Energy and Public Works

lower

Feb 26, 2025

Introduced

Introduced in House

lower

1 primary · 3 co-sponsors