WV HB2987

Establishes the Consumer Data Protection Act applying to businesses that control or process personal data of at least 100,000 West Virginia consumers, or derive over 50% of gross revenue from selling personal data and control data of at least 25,000 consumers, or have annual gross revenues exceeding $25 million in the state

Grants consumers rights to access, correct, delete, and obtain copies of their personal data, as well as opt out of targeted advertising, sale of personal data, and automated profiling that produces legal or significant effects

Creates a Safe Harbor for Cybersecurity Programs providing businesses an affirmative defense against punitive damages in data breach lawsuits if they maintain a written cybersecurity program conforming to recognized frameworks such as NIST standards, HIPAA, or ISO 27000

Exempts government entities, nonprofit organizations, institutions of higher education, financial institutions governed by Gramm-Leach-Bliley Act, and HIPAA-covered entities from the consumer data protection requirements

Authorizes the Attorney General to enforce violations with civil penalties up to $7,500 per violation, with a required 60-day cure period before enforcement action; effective date of July 1, 2026