Law / United States / 
West Virginia
West Virginia Consumer Data Protection Act, HB 2987 (2025 Regular Session)
W. Va. Code secs. 46A-6O-1 to 46A-6O-11 (H.B. 2987)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Withdrawn: no longer proceeding.
A comprehensive regime rule binding private bodies.
As of 28 August 2026.
What it requires
- This bill never became law. It passed the House on 2025-03-26 and died in Senate committee without further action; do not treat it as binding.
- If a similar bill returns in a future West Virginia session, note that this bill's biometric data definition excluded a photograph, video, or audio recording, or data generated from either, unconditionally, with no exception for data generated to identify someone.
- This bill would have foreclosed a private right of action for its own subject matter and, in a companion article, for cybersecurity-program litigation defenses as well.
If you get it wrong
Private right of actionNo
What it reaches
Excludes recording-derived identifiersYes
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
House Bill 2987, as passed by the House (Engrossed Committee Substitute), would have created a Consumer Data Protection Act at new Chapter 46A, Article 6O, applying to a person doing business in West Virginia that controls or processes personal data of at least 100,000 consumers, or that derives over 50% of gross revenue from selling personal data while processing at least 25,000 consumers' data.
Controllers would have owed data-subject rights (access, correction, deletion, portability, opt-out of targeted advertising, sale, and significant-effect profiling, on a 45-day response deadline extendable once by 45 days) and data protection assessments for high-risk processing.
Biometric data would have been defined as data from automatic measurements of biological characteristics used to identify a specific individual, but the definition excluded a photograph, video, or audio recording, or data generated from either, unconditionally, with no clawback for data generated to identify someone, the same shape as Indiana's, Florida's, and Pennsylvania's proposed equivalent.
Genetic or biometric data processed to uniquely identify a person would have been sensitive data requiring opt-in consent. This bill passed the House 26 March 2025, was referred to Senate Judiciary and then Finance the next day, and received no further action before the 2025 Regular Session adjourned; West Virginia's annual, non-carrying session numbering means it did not return in 2026, and the bill number was not reused for an unrelated 2026 law.
It never became law and has no current legal effect. A companion article the same bill would have created, Chapter 31A, Article 8H (a cybersecurity-program litigation safe harbor), separately and independently foreclosed a private right of action for its own subject matter.
When LexLint raises it
automated_outreachcrawls_webdeploys_chatbotprocesses_biometricsprocesses_voicetrains_modelshigh_risk_decisions
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.