Technology

Elections; political campaign advertisements; synthetic media; penalty. Prohibits electioneering communications containing synthetic media, as those terms are defined in the bill, from being published or broadcast without containing the following conspicuously displayed statement: "This message contains synthetic media that has been altered from its original source or artificially generated and may present conduct or speech that did not occur." The bill creates a civil penalty not to exceed $25,000 for a violation of such prohibition and a Class 1 misdemeanor for a willful violation. The bill permits any registered voter who receives an electioneering communication in violation of this requirement to institute an action for preventative relief to prohibit the publication or dissemination of such electioneering communication, including an application for a permanent or temporary injunction.

Virginia Lottery; powers of the Virginia Lottery Board; advertising restrictions; age verification. Directs the Virginia Lottery to study the feasibility of furthering responsible gaming as it relates to the lottery, casino gaming, and sports betting, and to develop an implementation plan to require all lottery terminals to possess proper age verification software to ensure that a consumer is 18 years of age or older. The Director of the Virginia Lottery shall report any findings to the Chairs of the House Committee on General Laws and the Senate Committee on General Laws and Technology by October 1, 2026.

Consumer Data Protection Act; social media platforms and operators; interoperability interfaces. Requires social media platforms and operators, defined in the bill, to implement third-party interoperability interfaces to allow users to share social graph data, defined in the bill, and contextual data associated with artificial intelligence systems, defined in the bill, as the user designates. The bill has a delayed effective date of July 1, 2027.

Commonwealth of Virginia Innovation Partnership Act; Regional Innovation Fund; Commonwealth Commercialization Fund; matching funds. Provides that, for purposes of the Regional Innovation Fund and the Commonwealth Commercialization Fund, any awards from such funds of $100,000 or less shall not require matching funds.

State government; transaction of public business; prohibited website domains. Prohibits a public body, defined in the bill, from maintaining an official website for public use with a domain other than a .gov, .edu, or .museum domain. The bill provides that any email address that a public body provides to its employees shall utilize a .gov domain and directs the Virginia Information Technologies Agency to promulgate regulations to implement the provisions of the bill. The bill has a delayed effective date of July 1, 2029.

Virginia Human Rights Act; equal credit opportunities; Virginia Fair Housing Law; nondiscrimination by automated decision systems. Provides that it is an unlawful discriminatory practice for any person to deploy, use, or rely on an automated decision system to make a decision pursuant to the Virginia Human Rights Act, provisions related to equal credit opportunities, or the Virginia Fair Housing Law that results in discrimination or an unlawful disparate impact or that intentionally or knowingly uses variables or data fields that serve as close proxies for protected characteristics. The bill requires a person that deploys, uses, or relies on such a system to (i) disclose the use of such system to any individual who is the subject of such decision; (ii) annually assess such system for bias, disparate impact, and discriminatory outcomes; and (iii) maintain for no fewer than two years from the date a decision is made certain documentation relating to such system.

Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act established. Establishes the Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act (FAIR AI Act) that requires a developer of a base artificial intelligence model, as defined in the bill, to clearly and conspicuously disclose, in a manner that is appropriate for the medium of the content and is easily accessible to the user of such model, in the terms of service governing the use of such model, certain elements related to the artificial intelligence system. The bill creates the FAIR AI Enforcement Fund for the purpose of supporting agency enforcement of artificial intelligence system misuse, bias, and workforce disruption. Finally, the bill limits the defenses available in any criminal or civil action against a defendant that is alleged to have developed, modified, or deployed an artificial intelligence system that caused harm to a plaintiff. The bill has a delayed effective date of July 1, 2027.

Employment decisions; automated decision systems; civil penalty. Provides that the Director of the Department of Human Resource Management shall require any state agency that uses an automated decision system as a substantial factor in any employment decision, as those terms are defined in the bill, to (i) ensure that such system and the use of such system complies with federal and state law, (ii) make certain disclosures, (iii) provide an opt-out mechanism, (iv) annually test such system, (v) ensure data security, and (vi) train agency staff on such system. The bill requires the Department and local government employers to establish and publicize a process for applicants for employment and employees to file concerns and complaints regarding the use of automated decision systems in such employment decisions and a process for the investigation and resolution of any such concerns and complaints. The bill also provides that no final employment decision shall be made by an employer without the involvement of a human decision maker, and no employer shall solely use any recommendation or prediction from an automated decision system to make a final employment decision. The bill subjects violating employers to civil penalties.

Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data. Provides that, under the Consumer Data Protection Act, no consumer, controller, processor, or affiliate of the controller or processor shall process biometric data, defined separately in the bill, concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act.

Virginia Telephone Privacy Protection Act; voice service providers; duty of care; caller identification authentication; civil penalties. Provides that a voice service provider, defined in the bill, owes an affirmative duty of care to take reasonable and effective measures to prevent the origination, transmission, and completion of unlawful calls. The bill requires voice service providers to implement caller identification authentication technology consistent with the Secure Telephone Identity Revisited and Secure Handling of Asserted information using toKENs (STIR/SHAKEN) authentication framework, defined in the bill, in all internet protocol network segments under its control and shall implement functionally equivalent authentication, verification, or mitigation measures in non-internet protocol network segments to the extent technically feasible. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act.