Virginia Passes Data Privacy Law

Virginia Governor Ralph Northam signed a data privacy bill into law on Tuesday. It's the second in the nation meant to protect American's data online, bringing the U.S. a step closer to federal privacy law. The Virginia law, called the Consumer Data Protection Act, is generally seen as a more industry-friendly statute than its California Consumer Privacy Act (CCPA) counterpart, which was first signed into law in 2018 and amended in November, and has been compared to Europe’s General Data Protection Regulation (GDPR). Nonetheless, marketers and publishers need to be vigilant to remain on the right side of the law. “This is a huge step forward,” said Virginia Democratic Senator David Marsden, who sponsored the bill, in a statement. “By creating this omnibus bill, we take the lead in data privacy in the United States. This omnibus bill is clear, concise and holds companies accountable for protecting consumer data in providing protections for consumers.” User privacy is top of mind as global regulators crack down on the flagrant exploitation of user data for financial gain within the digital ad ecosystem. Browsers are also finessing the data ad buyers can use to target audiences as third-party cookies disintegrate. For publishers, the concern is people opting out from sharing their data, which reduces their addressable audience pool. Not to mention, a patchwork of state laws with different parameters will complicate digital businesses working nationwide. More watered down than California Virginia’s law is similar to CCPA, but has a few key differences. One main distinction is there is no gross revenue threshold like in California where the law applies to corporations taking in $25 million per year. The Virginia law applies to corporations that control the personal data of more than 100,000 Virginians in a year or those who control the data of 25,000 people but make more than 50% of their gross revenue by selling user data. Adweek's Privacy Guide takes a state-by-state look at privacy laws Another difference is that, for consumers, the Virginia law does not afford citizens the right to sue through a private right of action for data security breaches. And complaints will be handled through Virginia’s attorney general, not a new enforcement agency like California’s law will create. Privacy advocates said the law doesn’t go far enough, and many requested that Northam veto the bill, which was backed by Microsoft and Amazon. According to Protocol, an Amazon lobbyist first approached Marsden with an early draft of the bill. “Virginia’s legislature has passed a bill meant to protect consumer privacy,” wrote Hayley Tsukayama, a legislative activist for the Electronic Frontier Foundation, one of the groups that pushed for a veto. But the bill “really protects the interests of business far more than the interests of everyday consumers.” These differences make it more complex for online businesses, too. “There are differences between the California law and the Virginia law, and those inconsistencies themselves are not industry-friendly,” said Justin Antonipillai, founder and CEO of the data privacy consultancy WireWheel.io and a former acting undersecretary at the U.S. Department of Commerce. “We are looking at a year in which companies—especially small companies—are likely to find it more difficult to know just what they need to do when they advertise.” “If you want to have some fun, sit down, read the Virginia and California laws, and try to figure out exactly what you are supposed to do on your website,” Antonipillai continued. There's work to be done When it takes effect at the start of 2023—also when California’s updated law takes effect— Virginia’s CDPA would allow users to opt out of having their data collected and sold. Additionally, the law says businesses need user permission to collect racial, ethnic, geographic or genetic data. Publishers could have smaller audiences to monetize as readers opt-out, in addition to the technical and product work involved and communicating their value to audiences. “In general, we are supportive of privacy regulation and have adapted to California regulations so far,” David Chavern, president and CEO of the News Media Alliance, said. “It is really all about implementation and whether compliance requirements aimed at Google and others are shoved down to publishers. That is an unfolding story.” More than a dozen other states, including New York and Washington, have data privacy bills currently introduced in their legislatures. Analysts expect that a federal privacy law could be passed during President Joe Biden’s first term in office, pushed by a patchwork of state laws that will make it tricky for businesses. Dave Grimaldi, executive vice president for public policy at the Interactive Advertising Bureau, said that each new state's privacy law increases the burden on businesses trying to comply. “Most industries don’t want congressional scrutiny and microscopes on them,” Grimaldi told Adweek. “We’re at the stage now where we know we’re a regulated industry. We need Congress to step in because, in the absence of that, you’re going to have these multi-state opt-in and consent regimes that are really going to start wreaking havoc on people’s daily lives.”

Politics

Virginia Passes Data Privacy Law, Reigniting Calls for a Federal Solution

It's the second state in the nation to pass regulations

Scott Nover

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Scott Nover