Law note · West Virginia
West Virginia Consumer Data Protection Act, HB 2987 (2025 Regular Session)
House Bill 2987, as passed by the House (Engrossed Committee Substitute), would have created a Consumer Data Protection Act at new Chapter 46A, Article 6O, applying to a person doing business in West Virginia that controls or processes personal data of at least 100,000 consumers, or that derives over 50% of gross revenue from selling personal data while processing at least 25,000 consumers' data.
Controllers would have owed data-subject rights (access, correction, deletion, portability, opt-out of targeted advertising, sale, and significant-effect profiling, on a 45-day response deadline extendable once by 45 days) and data protection assessments for high-risk processing.
Biometric data would have been defined as data from automatic measurements of biological characteristics used to identify a specific individual, but the definition excluded a photograph, video, or audio recording, or data generated from either, unconditionally, with no clawback for data generated to identify someone, the same shape as Indiana's, Florida's, and Pennsylvania's proposed equivalent.
Genetic or biometric data processed to uniquely identify a person would have been sensitive data requiring opt-in consent. This bill passed the House 2025-03-26, was referred to Senate Judiciary and then Finance the next day, and received no further action before the 2025 Regular Session adjourned; West Virginia's annual, non-carrying session numbering means it did not return in 2026, and the bill number was not reused for an unrelated 2026 law.
It never became law and has no current legal effect. A companion article the same bill would have created, Chapter 31A, Article 8H (a cybersecurity-program litigation safe harbor), separately and independently foreclosed a private right of action for its own subject matter.
What it asks of an app
- This bill never became law. It passed the House on 2025-03-26 and died in Senate committee without further action; do not treat it as binding.
- If a similar bill returns in a future West Virginia session, note that this bill's biometric data definition excluded a photograph, video, or audio recording, or data generated from either, unconditionally, with no exception for data generated to identify someone.
- This bill would have foreclosed a private right of action for its own subject matter and, in a companion article, for cybersecurity-program litigation defenses as well.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models, high_risk_decisions
Primary source: official West Virginia bill text, HB 2987 (2025 Regular Session), Engrossed Committee Substitute, West Virginia Legislature website