West Virginia, USA

Regulator And AuthorityAmber

The West Virginia Attorney General enforces the state breach-notification statute and exercises general consumer-protection authority; no dedicated DPA exists.

Claims (2):

• The West Virginia Attorney General is the primary state authority exercising consumer-protection powers relevant to data-privacy matters in West Virginia.
• The FTC's Section 5 unfair/deceptive-practices authority under the FTC Act applies nationally, including to West Virginia, as the primary federal privacy-enforcement backstop.

Act And InstrumentsRed

The operative state instrument is the Breach of Security of Consumer Information statute; no omnibus privacy act exists despite repeated legislative attempts.

Claims (2):

• West Virginia's Breach of Security of Consumer Information statute (W. Va. Code Chapter 46A, Article 2A, §46A-2A-101 et seq.) is the state's only codified data-protection-adjacent instrument.
• Multiple comprehensive consumer-data-protection bills have been introduced in the West Virginia Legislature (e.g., HB 3159 in 2021 and HB 3498 in 2023) but none has been enacted into law.

Material ScopeRed

Material scope is limited to the narrow 'personal information' definition used for breach-notification purposes (e.g., SSN, driver's license/state ID, financial account numbers with access codes); there is no broader definition of 'personal data' as in omnibus regimes.

Claims (1):

• State breach-notification statutes, including West Virginia's, define 'personal information' narrowly around identity-theft and financial-fraud data elements rather than the broad 'personal data' concept used in comprehensive privacy regimes.

Territorial ScopeAmber

No state statute articulates extraterritorial application; the breach law applies functionally to any entity holding computerized personal information of West Virginia residents, consistent with the general pattern across US state breach statutes.

Claims (1):

• West Virginia has no statute articulating extraterritorial/non-established-controller application analogous to GDPR Article 3; applicability is inferred functionally from residency of affected individuals under the breach statute.

Regulator Registration And FilingRed

No controller/processor registration or filing obligation exists in West Virginia absent a comprehensive privacy statute.

Claims (1):

• West Virginia imposes no controller or processor registration/filing obligation for data-processing activities.

Lawful BasesRed

No enumerated lawful bases for processing exist under West Virginia law; no general processing-lawfulness statute has been enacted.

Claims (1):

• West Virginia has not enacted a general statute enumerating lawful bases for personal-data processing.

Consent ThresholdsAmber

Consent standards apply only where a federal sectoral statute (HIPAA, GLBA, COPPA) independently requires consent; there is no general 'freely given, informed, revocable' consent standard under state law.

Claims (1):

• Consent obligations applicable to entities operating in West Virginia derive from federal sectoral statutes (HIPAA, GLBA, COPPA) rather than a state-level consent standard.

Special CategoriesRed

No state special/sensitive-category data statute exists (health, biometric, genetic, etc. are addressed only through sector-specific federal law or unenacted state bills).

Claims (1):

• A West Virginia bill relating to genetic information privacy was introduced in 2023 but has not been enacted, leaving genetic data without dedicated state-law protection.

Pseudonymisation And AnonymisationRed

No statutory definition or safe-harbour for pseudonymised or anonymised data exists in West Virginia law.

Claims (1):

• No West Virginia statute defines pseudonymisation or anonymisation or provides an associated compliance safe-harbour.

Access RightRed

No enacted state-law access right; proposed in unenacted bills only.

Claims (1):

• West Virginia House Bill 3159 (2021) proposed a consumer right to request a copy of personal data collected, but was not enacted.

Rectification And ErasureRed

No enacted correction/deletion right exists at state level.

Claims (1):

• West Virginia House Bill 3159 (2021) proposed rights to have personal information deleted or corrected, but the bill did not become law.

Restriction And ObjectionRed

No restriction-of-processing or objection/profiling opt-out right exists under West Virginia law.

Data PortabilityRed

No portability right exists under West Virginia law.

Deadlines And Response WindowsRed

No statutory response-window applies to privacy requests since no underlying rights framework exists; only breach-notification timing applies (see controller_processor_duties.breach_notification).

Claims (1):

• In the absence of an enacted comprehensive privacy statute, no statutory deadline governs controller responses to consumer privacy requests in West Virginia.

Accountability And DpiaRed

No accountability principle or DPIA-trigger requirement exists under West Virginia state law.

Claims (1):

• West Virginia has not enacted an accountability principle or DPIA-trigger requirement analogous to GDPR Articles 5, 25 and 35.

Dpo RequirementsRed

No DPO appointment threshold exists under West Virginia law.

Ropa RequirementsRed

No records-of-processing obligation exists under West Virginia law.

Joint Controller ArrangementsRed

No statutory joint-controller framework exists under West Virginia law.

Security MeasuresAmber

Technical and organisational security-of-processing obligations apply to West Virginia entities only through sector-specific federal law (HIPAA Security Rule for PHI; GLBA Safeguards Rule for financial institutions).

Claims (1):

• The GLBA Safeguards Rule requires financial institutions operating in West Virginia to maintain a comprehensive information-security program protecting nonpublic personal information, and the HIPAA Security Rule imposes analogous obligations on covered health entities.

Breach NotificationGreen

W. Va. Code Chapter 46A, Article 2A imposes a binding breach-notification duty on entities holding computerized personal information of West Virginia residents, generally following the common US-state pattern of notice to affected residents (and, above a numeric threshold, to the Attorney General and consumer reporting agencies).

Claims (1):

• West Virginia's Breach of Security of Consumer Information statute (W. Va. Code Chapter 46A, Article 2A) requires notification to affected residents following unauthorized acquisition of computerized personal information, consistent with the nationwide pattern of state breach-notice laws now enacted in all 50 states.

Retention And DisposalAmber

No general state-law retention limit exists; retention/disposal duties apply only via sectoral federal rules (e.g., HIPAA, GLBA record-keeping requirements).

Claims (1):

• No general West Virginia state statute imposes a retention limit or disposal duty on personal data outside sector-specific federal rules.

Transfer MechanismsRed

No state-law transfer mechanism (adequacy, SCCs, BCRs, derogations) exists; cross-border flows are governed only by general federal sectoral rules where applicable (e.g., GLBA, HIPAA cross-border considerations).

Claims (1):

• West Virginia has not enacted any statute establishing a cross-border data-transfer mechanism analogous to GDPR Chapter V.

Adequacy ReceivedRed

West Virginia, as a US state, is not a subject of any foreign adequacy determination.

Adequacy GrantedRed

West Virginia has no authority to grant adequacy status to other jurisdictions.

Sccs And BcrsRed

No SCC/BCR framework exists or is required under West Virginia law.

Transfer Impact AssessmentRed

No transfer-impact-assessment requirement exists under West Virginia law.

Data LocalisationRed

No data-localisation mandate exists under West Virginia law.

Claims (1):

• No West Virginia statute mandates data localisation for personal or sensitive data.

Financial Sector OverlayAmber

GLBA's Privacy Rule and Safeguards Rule govern financial institutions operating in West Virginia; a state-level consumer financial privacy bill was introduced but its enactment status is unconfirmed.

Claims (2):

• The Gramm-Leach-Bliley Act imposes an affirmative and continuing obligation on financial institutions to protect the privacy and security of customers' nonpublic personal information, applicable to institutions operating in West Virginia.
• A West Virginia bill on consumer financial privacy was introduced in 2023; this research did not confirm subsequent enactment.

Health Sector OverlayGreen

HIPAA Privacy and Security Rules govern covered entities and business associates handling protected health information in West Virginia.

Claims (1):

• HIPAA's Privacy and Security Rules apply to covered entities and business associates handling protected health information for West Virginia patients.

Telecoms And EprivacyAmber

No West Virginia state-level ePrivacy or cookie-consent statute exists; federal TCPA/CAN-SPAM rules apply nationally to telemarketing and commercial email.

Claims (1):

• West Virginia Code Chapter 46A, Article 6F regulates telemarketing activity within the state, supplementing federal telemarketing and commercial-email rules.

Employment DataRed

No West Virginia-specific employment-data-privacy statute was identified in this research pass.

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , e, m, p, l, o, y, m, e, n, t, , d, a, t, a, , p, r, i, v, a, c, y, , s, t, a, t, u, t, e.

Credit And ScoringGreen

The federal Fair Credit Reporting Act governs credit reporting and scoring activities affecting West Virginia consumers.

Claims (1):

• The federal Fair Credit Reporting Act governs the collection, use and disclosure of consumer credit information and scoring nationally, including for West Virginia consumers.

EducationAmber

The federal Family Educational Rights and Privacy Act governs education records for West Virginia students; a 2023 state bill addressing minors' online privacy was introduced but not confirmed enacted.

Claims (2):

• The federal Family Educational Rights and Privacy Act governs the privacy of student education records in West Virginia schools.
• West Virginia House Bill 2460, seeking to enhance online privacy protection for minors, was introduced to the Legislature in 2023; enactment was not confirmed in this research pass.

InsuranceRed

No confirmation was found that West Virginia has adopted the NAIC Insurance Data Security Model Law; insurance entities remain subject to GLBA as a baseline federal overlay.

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , I, n, s, u, r, a, n, c, e, , D, a, t, a, , S, e, c, u, r, i, t, y, , A, c, t, , N, A, I, C, , m, o, d, e, l, , l, a, w, , a, d, o, p, t, i, o, n.

Claims (1):

• The NAIC Insurance Data Security Model Law is a non-binding model instrument; this research did not confirm its adoption into West Virginia statute.

Cookies And TrackersRed

No state cookie/tracker consent statute exists in West Virginia.

Claims (1):

• West Virginia has not enacted a cookie or tracker consent statute of the kind found in comprehensive state privacy laws.

Dark PatternsRed

No West Virginia statute prohibits dark patterns in consent or privacy interfaces.

Opt Out SignalsRed

West Virginia does not require recognition of Global Privacy Control or other universal opt-out signals.

Claims (1):

• West Virginia law does not mandate recognition of universal opt-out mechanisms such as Global Privacy Control.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room regulation exists under West Virginia law.

Cross Context AdvertisingRed

No CPRA-style 'sale' or 'share' opt-out right exists for cross-context behavioral advertising under West Virginia law.

Claims (1):

• No enacted West Virginia statute provides consumers an opt-out right for the sale or sharing of personal information for cross-context behavioral advertising.

Direct MarketingAmber

West Virginia's telemarketing statute (Ch. 46A, Art. 6F) is the only direct-marketing-adjacent instrument, alongside applicability of the federal Telephone Consumer Protection Act and CAN-SPAM Act.

Claims (1):

• West Virginia Code Chapter 46A, Article 6F regulates telemarketing practices within the state.

Profiling RestrictionsRed

No enacted profiling-restriction statute analogous to GDPR Article 22 exists in West Virginia.

Claims (1):

• West Virginia has not enacted a profiling-restriction statute analogous to GDPR Article 22.

Automated Decision Making TransparencyRed

No ADM transparency or explanation-right statute exists under West Virginia law.

Ai Risk AssessmentsRed

No AI-specific risk-assessment requirement exists under West Virginia law.

Biometric RegimeAmber

A Biometric Information Privacy Act bill was introduced in the West Virginia Legislature in February 2026 but has not been confirmed enacted.

Claims (1):

• A bill proposing a West Virginia Biometric Information Privacy Act was introduced in the state Legislature in February 2026.

Genetic DataAmber

A bill relating to genetic information privacy was introduced in West Virginia in 2023 but has not been confirmed enacted.

Claims (1):

• A West Virginia bill relating to genetic information privacy was introduced in February 2023 but has not been confirmed enacted into law.

State Surveillance CarveoutsRed

No West Virginia-specific state-surveillance carve-out framework was identified; national-security/law-enforcement exemptions operate through general federal law only.

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , s, t, a, t, e, , s, u, r, v, e, i, l, l, a, n, c, e, , c, a, r, v, e, o, u, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , l, a, w, , e, n, f, o, r, c, e, m, e, n, t, , e, x, e, m, p, t, i, o, n.

Age VerificationAmber

No West Virginia state-law age-verification mandate was confirmed enacted; federal COPPA age-verification/actual-knowledge standards apply to operators nationally.

Claims (1):

• COPPA imposes requirements on operators of websites or online services directed to children under 13, or with actual knowledge of collecting children's personal information, applicable nationally including West Virginia.

Parental ConsentAmber

COPPA's verifiable-parental-consent requirement is the operative standard for children under 13 using online services accessible in West Virginia; no state-law equivalent exists.

Claims (1):

• A West Virginia bill (HB 2460) seeking to enhance online privacy protection for minors was introduced to the Legislature in January 2023; this research did not confirm its enactment.

Minor Profiling BansRed

No West Virginia statute bans profiling of minors.

Education SettingsAmber

FERPA governs education-record privacy for West Virginia students; no state-specific education-privacy statute beyond FERPA was confirmed.

Claims (1):

• FERPA governs the privacy of student education records nationally, including for West Virginia students, absent a state-specific supplementary statute.

Dependent AdultsRed

No West Virginia statute specifically addresses data protection for dependent adults (elderly or mentally incapacitated persons).

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , d, e, p, e, n, d, e, n, t, , a, d, u, l, t, s, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , e, l, d, e, r, l, y, , p, r, i, v, a, c, y, , s, t, a, t, u, t, e.

Regulator Powers And PenaltiesAmber

The West Virginia Attorney General may bring enforcement actions for breach-notification violations under general consumer-protection powers; the FTC may act under Section 5 for unfair/deceptive privacy practices nationally.

Claims (1):

• The FTC exercises Section 5 unfair/deceptive-practices enforcement authority nationally, including over entities operating in West Virginia, as the principal federal backstop absent a state comprehensive-privacy penalty regime.

Enforcement Activity IndexAmber

No major West Virginia-specific privacy/breach enforcement action was identified in this research pass covering the last 12 months.

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , A, t, t, o, r, n, e, y, , G, e, n, e, r, a, l, , d, a, t, a, , b, r, e, a, c, h, , e, n, f, o, r, c, e, m, e, n, t, , a, c, t, i, o, n, , 2, 0, 2, 5, , 2, 0, 2, 6.

Regulator Funding And CapacityRed

No specific funding or headcount data for a dedicated privacy unit within the West Virginia Attorney General's office was identified; privacy enforcement is folded into general consumer-protection functions.

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , A, t, t, o, r, n, e, y, , G, e, n, e, r, a, l, , c, o, n, s, u, m, e, r, , p, r, o, t, e, c, t, i, o, n, , d, i, v, i, s, i, o, n, , s, t, a, f, f, i, n, g, , b, u, d, g, e, t.

Collective Redress And Class ActionsRed

No data-privacy-specific collective-redress mechanism was confirmed for West Virginia; general consumer-protection class-action avenues may apply under state civil procedure.

Absence provenance: unavailable. Searched: W, e, s, t, , V, i, r, g, i, n, i, a, , d, a, t, a, , b, r, e, a, c, h, , c, l, a, s, s, , a, c, t, i, o, n, , p, r, i, v, a, t, e, , r, i, g, h, t, , o, f, , a, c, t, i, o, n, , s, t, a, t, u, t, e.

Private Right Of ActionRed

West Virginia's breach-notification statute does not appear to confer a private right of action distinct from general consumer-protection remedies; this was not independently confirmed via direct statutory text in this research pass.

Claims (1):

• This research did not confirm a data-privacy-specific private right of action under West Virginia state law distinct from general consumer-protection remedies.

Recent Developments 180DAmber

The most notable recent development is the February 2026 introduction of a West Virginia Biometric Information Privacy Act bill; no comprehensive privacy statute has been enacted in West Virginia within the last 180 days.

Claims (1):

• A bill proposing a West Virginia Biometric Information Privacy Act was introduced in February 2026, representing the most recent notable state-level privacy legislative development.