WASHINGTON (DC News Now) — As millions of Americans flock online to find holiday deals on gifts, personal data is collected by companies.

While the data collection, where information can be sold to advertisers, the longstanding practice does not exclusively occur during the busiest shopping months of the year.

130 million people bought products online over the Thanksgiving holiday weekend, according to the National Retail Federation–adding that 42% of all weekend purchases were made on the web.

As federal lawmakers have not yet passed widespread personal data protections, DC News Now looked in to local laws that may prevent consumers’ data from being sold.

In the DMV, Virginia lawmakers passed a bill to allow consumers to opt-out of their data being processed for targeted ads, as well as the ability to request a copy of this data.

This law goes into effect on January 1.

A similar bill failed to gain momentum in West Virginia this year. Maryland and Washington DC do not have laws like Virginians are slated to have in January; however, the state and the district do require companies to tell consumers when their information has been breached.

The digital advertising industry is a billion-dollar business, and it’s why lawmakers US Senate Intelligence Committee Chairman Mark Warner says he wants to expand protections for personal data.

Congress ought to get a lump of coal and that is on having any kind of protections or guardrails around social media and technology,” Warner said. “We need to do a better job at realizing these services come with, sometimes, a hidden cost — and that hidden cost may be your very personal, private data.”

As consumers use phone apps in addition to retail websites to purchase goods, Dr. Susan Aaronson, a research professor of digital trade at George Washington University said, app store systems differ on data collection requirements levied on companies.

“The app is basically a tool to get people’s data, and a lot of times those apps, they may have one purpose but they talk all sorts of data unrelated to them,” Aaronson said, adding “the app that you’re using has to follow the Android system or IOS systems’ — Apple’s systems’ — rules in their app store.”

Historically, consumer protection concerns should be brought to state attorneys generals.