West Virginia

Senate Bill 198 (2025) amended West Virginia's Filming of Sexually Explicit Conduct of Minors article to define computer-generated child pornography as a visual portrayal of an identifiable minor that has been created, adapted, or modified to depict the minor engaged in sexually explicit conduct, or a visual portrayal that appears to depict a minor engaged in sexually explicit conduct where the portrayal was created by artificial intelligence or other computer technology and is indistinguishable from a minor.

Any person who knowingly sends, distributes, exhibits, possesses, electronically accesses with intent to view, displays, or transports such material, alongside traditional child pornography, is guilty of a felony, with three graduated sentencing tiers keyed to the number of images involved. The prohibition binds any person and does not depend on whether the depicted minor's actual identity can be ascertained.

Senate Bill 198 (2025) amended West Virginia's nonconsensual disclosure of private intimate images statute to add a fabricated intimate image, an image of an identifiable person that was created using artificial intelligence or other computer technology and depicts computer-generated intimate parts, or the intimate parts of another person, as that individual's own.

No person may knowingly and intentionally disclose, cause to be disclosed, or threaten to disclose a fabricated intimate image, or a genuine intimate image captured with a reasonable expectation of privacy, with intent to harass, intimidate, threaten, humiliate, embarrass, or coerce. A first violation is a misdemeanor; a second or subsequent violation is a felony.

The statute exempts images disclosed with prior written consent, images of voluntary public or commercial exposure, and disclosures made through lawful reporting, legal proceedings, or medical treatment, and it does not impose liability on an interactive computer service, information service, or telecommunications service provider for content supplied by another person.

An individual or entity that owns or licenses computerized data including personal information must give notice of a breach of the security of the system, without unreasonable delay, to any West Virginia resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person, where the breach causes or is reasonably believed to cause identity theft or other fraud.

Personal information is name plus a Social Security number, driver's license or state ID number, or a financial account number with access credential; health information, biometric data, and genetic data are not folded into this definition, unlike South Dakota's narrower biometric fold-in researched alongside this state. An entity required to notify more than 1,000 persons of a breach must also notify nationwide consumer reporting agencies.

A notice violation is deemed an unfair or deceptive act under West Virginia's general Consumer Credit and Protection Act, but the Attorney General has exclusive authority to bring that action (except against a licensed financial institution, enforced instead by its own primary regulator), which closes the private right of action that West Virginia's general unfair-trade-practices statute, W. Va. Code sec. 46A-6-106, would otherwise open for 'any person who purchases or leases goods or services' suffering an ascertainable loss.

This Act's own codified page carries no separate commencement date beyond its 2008 Regular Session enactment (S.B. 340), so no effective date is recorded here.

Section 61-3C-5 makes it a misdemeanor, fined $200 to $1,000 or up to one year in county jail, for any person to knowingly, willfully, and without authorization access or cause to be accessed a computer or computer network with the intent to obtain computer services; ordinary, non-deceptive automated access to a public page performed without such intent does not fit this offense's elements.

Section 61-3C-4 separately makes computer fraud, accessing a computer to execute a scheme to defraud or to obtain money, property, or services by fraudulent pretenses, a felony punishable by up to $10,000 and ten years, and makes introducing ransomware with intent to extort a separate felony punishable by up to $100,000 and ten years; a third tier in the same section punishes knowing, willful, unauthorized access to data stored in a computer owned by the Legislature with a fine of up to $5,000 and up to five years.

Authorization is defined as the express or implied consent a person gives another to access their computer, network, program, software, system, password, identifying code, or personal identification number.

Section 61-3C-17 provides a defense where the defendant had reasonable grounds to believe they had authority to access, or could not reasonably have known they lacked it, but the article contains no clause preserving or displacing ordinary contract or license terms, unlike Virginia's equivalent statute.

Section 61-3C-16 gives any person injured by a violation of the article a civil cause of action in circuit court for compensatory damages, punitive damages, and injunctive relief, brought within five years of the last act constituting a violation or two years of its discovery, whichever is earlier.

The Act was originally enacted in 1989 (S.B. 92) and has been amended repeatedly since, most recently by H.B. 2017 in 2021; the code's own pages carry no separate commencement date for the current text of the sections cited here beyond noting the enacting and amending sessions.

Requires a commercial entity that knowingly and intentionally publishes or distributes sexual material harmful to minors, where such material is a substantial portion (more than 33.33 percent) of the entity's content, to verify that a user is 18 or older using digital identification or a commercial or governmental age verification system. Exempts news gathering organizations, internet service providers, search engines, and cloud service providers.