Virginia governor signs nation’s second state consumer privacy bill

The Virginia law is widely viewed as more industry friendly than the California provision, however, and privacy advocates have called for Virginia to adopt some of California’s provisions that make it easier for people to opt out of data collection from multiple companies. The Virginia law also does not allow individuals to bring lawsuits against tech companies for violations and will be enforced by the state’s attorney general, not a separate enforcement agency.

The law is expected to take effect on Jan. 1, 2023. It also would require companies to get permission before collecting particularly sensitive types of data related to racial or ethnic origin, genetic data and geolocation.

State Sen. David W. Marsden (D-Fairfax), a sponsor of the bill, said the law’s passage would allow Virginia to “take the lead in data privacy in the United States.”

“This omnibus bill is clear, concise, and holds companies accountable for protecting consumer data in providing protections for consumers,” Marsden said in a statement.

Virginia’s law signals that states increasingly are taking on tech regulation after years of lack of action in Congress. Many other states, including Washington and New Jersey, are considering privacy legislation. Utah is considering legislation that is very similar to the Virginia bill.

A growing patchwork of different state laws could create more pressure on Congress to move forward on federal privacy legislation. Many proposals have been introduced at the federal level and faltered under partisan divisions, but as more states enact legislation, the tech industry may increase pressure for a national act so they only have to abide by a single set of rules, rather than many different state regulations.

Privacy advocates have widely viewed the Virginia law as a mixed bag. Although they have applauded Virginia for acting on consumer privacy, they are calling policymakers in the state to consider adding more protections before the law takes effect.

“While we’re pleased that Virginians will have new privacy rights, legislators should continue working in the next session to strengthen it,” Maureen Mahoney, senior policy analyst for Consumer Reports, said in a news release. “This bill has some important privacy provisions, but consumers need more practical options for controlling their data.”

Consumer Reports and other privacy advocates previously called on Virginia lawmakers to consider adding a requirement for a global opt-out browser setting, which people could turn on to alert companies that they want as little of their data collected as possible. They also requested that policymakers update the law to ensure that people can authorize outside agents to make requests on their behalf about how companies use their data.

“This is an important first step in providing vital privacy protections to Virginians,” said U.S. Sen. Mark R. Warner (D-Va.), a former venture capitalist who has advocated for greater regulation of the tech industry.

Warner called for a similar changes to make it easier for Virginians to opt out of data collection, as well as protections to specifically address online advertising and tactics that tech companies use to trick people into handing over their data. He has previously introduced legislation in Congress to address these concerns.

Northam’s administration will have an ongoing work group to continue to strengthen the law’s consumer protections, according to the news release from Marsden.

In an interview last month, Virginia Del. C.E. “Cliff” Hayes Jr. (D-Chesapeake), who introduced the bill in the House, said policymakers hope to consider such changes in the future, but they decided to begin with a basic framework to ensure that Virginia residents had baseline privacy protections.

“We learned that some of the other states were trying to take on so much that in the time frame you have to pass legislation it bogs it down,” he said.

Hayes also said he wanted to propose legislation in the future that specifically addresses data privacy concerns related to artificial intelligence and facial recognition.

A spokeswoman for Northam did not immediately respond to a request for comment.