Lawmakers in Virginia have passed a privacy bill similar to a law that took effect last year in California.
The bill now heads to Governor Ralph Northam, who is expected to sign the measure into law. If enacted, it will take effect in 2023.
The Virginia Consumer Data Protection Act (SB 1392), much like California's Consumer Privacy Act, requires companies to allow consumers to access, correct and delete personal data.
The bill gives consumers the right to opt out of the use of non-sensitive data for targeted advertising, and requires companies to obtain consumers' affirmative consent before processing “sensitive” data -- including information about race, religious beliefs, health, sexual orientation or immigration status, as well as precise geolocation information and some biometric data.
The measure gives the Attorney General sole authority to sue violators.
A provision that was added to the bill last week establishes a working group that could recommend revisions to the bill before it goes into effect in 2023.
Microsoft and Amazon testified in favor of the bill, but some consumer advocates criticized it as being too weak.
For instance, Consumer Federation of America proposed that it should be revised to require companies to obtain consumers' opt-in consent before using their information.
The group Consumer Reports also proposed several revisions, including adding a provision enabling people to opt out through a browser control, as opposed to on a company-by-company basis.
Last October, Consumer Reports said a study it conducted showed that consumers have difficulty opting out of the sale of their data, often because they can't find the opt-out links, or the procedure is burdensome, or the companies simply aren't complying with the law.
The group said at the time that consumers need access to browser-based controls.
In California, the state attorney general issued regulations that require companies to honor opt-out requests sent through browser controls. The ad industry opposes that requirement, arguing that the attorney general exceeded his authority by promulgating that regulation.
The digital rights group Electronic Frontier Foundation, which opposed the Virginia bill, is urging people to ask Northam to veto the measure.
Dan Jaffe, group executive vice president for government relations at the Association of National Advertisers, says the group doesn't plan to weigh in with Northam at this time.
“There are some changes that we think would improve the bill and we will be discussing them with legislators before the bill goes into operation,” Jaffe says.