RICHMOND, VA — Governor Ralph Northam signed the Consumer Data Protection Act (CDPA) into law today, making Virginia only the second state, after California, to ratify a comprehensive privacy bill.
Like the landmark California Consumer Privacy Act (CCPA), Virginia’s CDPA gives consumers the right to access, delete, and stop the sale of their personal information. Companies would need consumers’ permission before collecting, using, or disclosing particularly sensitive information, such as information relating to racial or ethnic origin, genetic data, and geolocation data. Companies would also be required to protect the data from unauthorized access, such as by hackers.
Consumer Reports praised the governor and legislature for taking action on privacy, while urging policymakers to consider adding additional protections for consumers before the law goes into effect on January 1, 2023.
“This is a historic moment for privacy rights,” said Maureen Mahoney, senior policy analyst for Consumer Reports. “Virginia is now just the second state to pass a comprehensive privacy bill. While we’re pleased that Virginians will have new privacy rights, legislators should continue working in the next session to strengthen it. This bill has some important privacy provisions, but consumers need more practical options for controlling their data.”
Among the improvements recommended by CR are a requirement for a global opt-out browser setting that would let people easily communicate they want as little data sharing as possible. Another change sought by CR is to ensure that authorized agents can make privacy requests on behalf of consumers to a broad range of companies. Consumer Reports’ model state privacy bill outlines an effective framework for protecting consumer privacy.
Consumer Reports has played a leading role in advocating for strong state and federal privacy legislation, has extensively studied how the CCPA’s opt-out provision is working for consumers, and has worked to create tools for California consumers to more effectively exercise their digital rights under the CCPA.
Media contact: Cyrus Rassool, cyrus.rassool@consumer.org