Privacy Laws in West Virginia: What You Need to Know

West Virginia is one of the remaining states without a comprehensive consumer data privacy law, but that may soon change. House Bill 2987, the Consumer Data Protection Act, was introduced in February 2025 and would give West Virginia residents meaningful control over their personal data for the first time. Here is what you need to know about privacy protections in West Virginia as of 2026, including existing laws that already protect you and the pending legislation that could reshape the landscape.

The Current State of Privacy Law in West Virginia

As of mid-2026, West Virginia does not have a comprehensive consumer privacy statute comparable to the laws in Virginia, California, Colorado, or the other 20-plus states that have enacted such legislation. This means West Virginia residents currently lack broad rights to access, delete, or control how businesses use their personal data.

However, West Virginia is not entirely without privacy protections. Several existing state laws address specific privacy concerns, and they remain important tools for residents.

Data Breach Notification Law

West Virginia's breach notification law, codified at WV Code sections 46A-2A-101 through 46A-2A-105, requires businesses and government agencies to notify West Virginia residents when a security breach compromises their personal information. Personal information under this law includes Social Security numbers, driver's license numbers, state ID numbers, and financial account information.

When a breach occurs, the entity must notify affected residents "without unreasonable delay." If more than 1,000 individuals are affected, the business must also notify all consumer reporting agencies. Failure to comply can result in enforcement action by the West Virginia Attorney General.

Wiretapping and Electronic Surveillance Laws

West Virginia is a one-party consent state for recording conversations. Under WV Code section 62-1D-3, you can legally record a phone call or in-person conversation as long as at least one participant in the conversation consents to the recording. This means you can record your own conversations, but you cannot secretly record a conversation between two other people without any of their knowledge.

Identity Theft Protections

West Virginia's identity theft statute (WV Code section 61-3-54) makes it a felony to knowingly use another person's identifying information, including Social Security numbers, dates of birth, and financial account numbers, to obtain goods, services, credit, or other benefits. Victims of identity theft can also place a security freeze on their credit reports at no cost.

House Bill 2987: The Consumer Data Protection Act

Introduced on February 26, 2025, House Bill 2987 would establish the West Virginia Consumer Data Protection Act (WVCDPA). The bill closely follows the framework established by Virginia and adopted by many other states. If enacted, it would represent a major step forward for consumer privacy in West Virginia.

Who Would Be Covered

HB 2987 would apply to businesses that conduct business in West Virginia or produce products or services targeted at West Virginia residents and meet at least one of the following thresholds:

• Control or process the personal data of 100,000 or more West Virginia residents during a calendar year, or
• Control or process the personal data of 25,000 or more West Virginia residents and derive more than 50% of gross revenue from the sale of personal data.

These thresholds are identical to those in the Virginia Consumer Data Protection Act and would capture most large businesses operating in the state, as well as smaller companies that are primarily in the business of selling data.

Consumer Rights Under HB 2987

The bill would grant West Virginia residents the following rights:

• Right to access — Confirm whether a business is processing your personal data and obtain a copy of it.
• Right to correct — Request correction of inaccurate personal data.
• Right to delete — Request deletion of personal data a business holds about you.
• Right to data portability — Obtain your personal data in a portable, commonly used format.
• Right to opt out of targeted advertising, the sale of personal data, and profiling that produces legally significant effects.

Data Protection Assessments

One of the more significant provisions of HB 2987 is its requirement for data protection assessments. Businesses would be required to conduct and document assessments before engaging in certain higher-risk activities, including:

• Processing personal data for targeted advertising
• Selling personal data
• Processing personal data for profiling
• Processing sensitive personal data

These assessments would need to weigh the benefits of the processing activity against the potential risks to consumers. The Attorney General could request these assessments during an investigation.

Enforcement and Penalties

HB 2987 would give the West Virginia Attorney General exclusive enforcement authority. There would be no private right of action, meaning individual consumers could not sue businesses directly for violations. Instead, violations would be handled by the AG's office, with civil penalties of up to $7,500 per violation.

If enacted as proposed, enforcement provisions would take effect on August 1, 2026.

How West Virginia Compares to Neighboring States

West Virginia's lack of a comprehensive privacy law puts it behind its neighbors:

• Virginia enacted the VCDPA in 2021, which has been fully enforced since January 2023 and expanded with new protections for minors in 2026.
• Pennsylvania has also moved toward comprehensive privacy legislation, reflecting the broader national trend.
• Ohio and Kentucky have enacted their own consumer data protection laws in recent years.

Without a state-level privacy law, West Virginia residents must rely on the narrower protections of existing statutes and whatever rights may be available under the privacy laws of other states where the businesses they interact with are headquartered.

What You Can Do Now to Protect Your Privacy

Even without a comprehensive state privacy law, West Virginia residents can take concrete steps to protect their personal data:

1. Search for yourself on people-search sites. Enter your name on sites like Spokeo, BeenVerified, and Whitepages to see what personal information is publicly available about you.
2. Submit opt-out requests to data brokers. Most data broker sites have opt-out processes, even if they are not required by West Virginia law. You can request removal of your personal information from these sites directly.
3. Freeze your credit. Contact Equifax, Experian, and TransUnion to place a security freeze on your credit reports. This prevents anyone from opening new accounts in your name.
4. Use other states' laws when possible. If a company operates in California, you may be able to submit a deletion request under the CCPA regardless of where you live. Many large businesses apply California's standards nationwide.
5. Use PrivacyOn for comprehensive protection. Manually opting out of data brokers one by one is tedious and requires constant follow-up, since brokers routinely re-list your information. PrivacyOn removes your data from over 100 data broker sites, monitors for reappearances around the clock, and includes dark web monitoring to alert you if your information surfaces in places you cannot reach on your own.

The Bottom Line

West Virginia has basic privacy protections through its breach notification law, wiretapping statutes, and identity theft provisions, but it lacks the comprehensive consumer data rights that a growing majority of states now provide. HB 2987 could change that, but until it passes, West Virginia residents are largely on their own when it comes to controlling how businesses collect, use, and sell their personal information.

The good news is that you do not have to wait for legislation. Taking proactive steps now — especially removing your data from broker sites with a service like PrivacyOn — gives you real privacy protection today, regardless of what the legislature decides tomorrow.