• by Wendy Davis  @wendyndavis, March 2, 2021

Virginia Governor Ralph Northam on Tuesday signed into law a privacy bill that gives consumers the right to opt out of the use of non-sensitive data for targeted advertising.

The Consumer Data Protection Act also requires companies to obtain consumers' affirmative consent before processing “sensitive” data -- including information about race, religious beliefs, health, sexual orientation or immigration status, as well as precise geolocation information and some biometric data.

As with California's broad Consumer Privacy Act, the Virginia law requires companies to allow consumers to access, correct and delete personal data.

The new law, slated to take effect on January 1, 2023, gives the Attorney General sole authority to sue violators.

Late last month, Virginia lawmakers voted to establish a working group that can recommend revisions to the measure before it goes into effect. 

Microsoft and Amazon supported the bill, while some consumer advocates criticized it as too weak.

For instance, the Consumer Federation of America said the law should require companies to obtain consumers' opt-in consent before using their information.

Consumer Reports also proposed several revisions, including a provision that would have enabled people to opt out of targeted advertising through a browser control, as opposed to on a company-by-company basis.  

In California, privacy regulations issued by Attorney General Xavier Becerra require web companies to honor requests by consumers to opt out of the sale of their data on a global basis.

Maureen Mahoney, a senior policy analyst at Consumer Reports, said Tuesday the organization is “pleased that Virginians will have new privacy rights,” but added that “legislators should continue working in the next session to strengthen” the law.

“This bill has some important privacy provisions, but consumers need more practical options for controlling their data,” she said.

Tuesday evening, Senator Mark Warner (D-Virginia) stated that the law is an “important first step in providing vital privacy protections to Virginians.”

But he added that he hopes Virginia “will improve this law in the near future in important ways,” including by enabling state residents to use a global privacy control to opt out of the use of their data.

Virginia state Senator David Marsden, a sponsor of the bill, tells MediaPost that lawmakers will be able to re-examine key provisions before the law takes effect.

“We're going to look at everything,” he says.

“We have a damn good bill here,” he adds. “We'll have the opportunity over the next year to add to it, change it, and fix what can be fixed.”