Keypoint: Five states are now considering online privacy legislation.

Virginia and Oklahoma join Washington, New York and Minnesota as states where lawmakers have proposed online privacy legislation this year. It is expected that lawmakers in other states will propose similar legislation in the coming weeks. As discussed in our prior posts, the fact the legislation has been proposed is not indicative of whether it has any chance of becoming law. Since lawmakers passed the California Consumer Privacy Act (CCPA) in 2018 numerous states have considered similar bills, but none of them has become law. That said, presumably one day another state (or more) will join California in passing such legislation.

Below is a brief summary of the two bills. To the extent that the bills appear poised for advancement we will provide a more detailed analysis.

In addition, on February 17, 2021, members of Husch Blackwell’s privacy and data security practice group will host a webinar to discuss all of the CCPA-like privacy bills proposed across the country. To register click here.


Senate Bill 1392 was offered by Senator Marsden on January 13, 2021. Readers of this blog may recall that last year two CCPA-like privacy bills were proposed in Virginia, both of which died in committee.

This year’s bill appears to closely track the 2021 version of the Washington Privacy Act. Among other things, the bill would allow Virginia residents to submit requests to controllers to: (1) confirm whether or not the controller is processing the consumer’s personal data and to access such personal data; (2) correct inaccuracies in the consumer’s personal data; (3) delete the consumer’s personal data; (4) obtain a copy of the consumer’s personal data that was previously provided to the controller in a portable and readily usable format; and (5) opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Controllers would also be required to provide privacy policies disclosing their data collection and privacy practices, enter into data processing agreements with processors, and perform data protection assessments for certain activities.

The law would be enforced by the Virginia Attorney General. If passed, it would go into effect on January 1, 2023.

The bill was referred to the Committee on General Laws and Technology.


House Bill 1130 was introduced by Representative Phillips on January 15, 2021. The bill tracks the verbiage used in the CCPA but is much more limited in scope than the CCPA and is more akin to the California Online Privacy Protection Act. The bill only would require businesses to post privacy policies with information regarding their data collection and privacy practices. It would not provide Oklahoma residents with any privacy rights regarding their personal information.

The bill would be enforced by the Oklahoma Attorney General. If passed, it would go into effect on November 1, 2021.