A coalition of consumer and privacy groups provide comments on the Consumer Data Protection Act (CDPA). Though consumers in Europe and California enjoy baseline privacy protections, Virginians currently do not have similar basic privacy rights. The CDPA would address this by extending to Virginia consumers the right to know the information companies have collected about them, the right to delete that information, and the right to stop the disclosure of certain information to third parties, with additional rights for sensitive data. These protections are long overdue: consumers are constantly tracked, and information about their online and offline activities are combined to provide detailed insights into a consumers’ most personal characteristics, including health conditions, political affiliations, and sexual preferences. This information is sold as a matter of course, is used to deliver targeted advertising, facilitates differential pricing, and enables opaque algorithmic scoring—all of which can lead to disparate outcomes along racial and ethnic lines.
We offer several suggestions to strengthen the proposed CDPA to provide the level of protections that Virginians deserve. At the very least, the CDPA should be modified to bring it up to the standard of the California Consumer Privacy Act (CCPA), which was recently strengthened by the passage of Proposition 24, the California Privacy Rights Act (CPRA).
Please see the attached PDF for the full letter.