Technology (Data Privacy)

Virginia Consumer Protection Act; prohibited practices; consumer reproductive or sexual health information. Provides that, for the Virginia Consumer Protection Act prohibition on obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without consumer consent, such prohibition does not apply to nonpublic personal information subject to the federal Gramm-Leach-Bliley Act.

Consumer Data Protection Act; data controller responsibilities; precise geolocation data. Provides that, for purposes of the Consumer Data Protection Act, a controller of personal data shall not sell or offer for sale precise geolocation data concerning a consumer.

Consumer Data Protection Act; individual action for damages or penalty; social media platforms. Allows a parent or minor who suffers loss as the result of a violation of Consumer Data Protection Act provisions relating to social media platforms to initiate an action against a controller or processor in violation of such provisions. The bill requires a parent or minor to provide a controller or processor 30 days' written notice and an opportunity for the controller or processor to cure the noticed violation prior to initiating such an action.

Artificial Intelligence Chatbots Act established; prohibited practices; penalties. Creates the Artificial Intelligence Chatbots Act, which prohibits an operator from making a companion chatbot, as those terms are defined in the bill, available to a user in the Commonwealth unless the companion chatbot is incapable of certain actions specified in the bill. The bill also requires an operator of a companion chatbot to include a disclaimer to users of all ages that a companion chatbot is not a human via a static, persistent disclosure and notify a user via a pop-up that he is not engaging with a human counterpart at specified intervals. The bill makes it unlawful for any operator of a companion chatbot to operate or provide a companion chatbot to a user unless such companion chatbot contains a protocol to take reasonable efforts for detecting and addressing expressions of suicidal ideation or self-harm by a user to the companion chatbot. The bill also includes certain data privacy and transparency requirements. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act.

Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties. Provides that any agency or political subdivision of the Commonwealth shall only disseminate personal information (i) to the extent necessary to comply with state or federal law, including the federal Health Insurance Portability and Accountability Act; (ii) to the extent necessary to carry out the administration of a state or federal program pursuant to state or federal law; (iii) to comply with a subpoena, court order, or administrative proceeding; (iv) to the extent necessary to ensure fulfillment of the obligations of a purchase or contract made in accordance with the Virginia Public Procurement Act or a memorandum of understanding or management agreement made in accordance with the Restructured Higher Education Financial and Administrative Operations Act; (v) when the data subject has given consent; or (vi) to the extent necessary to accomplish a proper purpose of the agency. The bill also prohibits an agency or political subdivision from selling personal information. The bill authorizes a court, in the case of a willful and knowing violation, to subject a specific public officer, appointee, or employee of any agency to civil penalties.

Department of Education; assessment; certified student support agencies; report. Requires the Department of Education (the Department) to assess the impact of developing a program to provide student support programs to students enrolled in a public elementary or secondary school through certified student support agencies, as defined in the bill. The bill requires the Department, in conducting such assessment, to consider (i) a framework by which a certified student support agency would enter into a memorandum of understanding with a school board for the purpose of providing student support programs, as defined in the bill, and suggested components of such memorandums of understanding, such as (a) documentation establishing the organization's nonprofit status, (b) a description of each student support program that such organization provides, (c) policies and procedures relating to privacy, background checks, mandated reporting, and the transmission, collection, use, and disposal of student personal information, and (d) consent forms and procedures to be used by such student support programs to obtain the necessary consent from the parent of any student under 18 years of age; (ii) the feasibility of establishing and administering a certification process for certified student support agencies; (iii) potential compliance monitoring and enforcement mechanisms and subsequent penalties for noncompliance to ensure that each certified student support agency complies with such program; (iv) policies and procedures for the secure disposal of a student's personal information upon such student's withdrawal from a student support program, upon the cessation of any such program, or upon such student's graduation or transfer from the school division; and (v) cost estimates, including staffing needs, for the development and implementation of such program. The bill requires the Department to submit a report on its findings to the Chairs of the Senate Committees on Finance and Appropriations and Education and Health and the House Committees on Appropriations and Education no later than November 1, 2026. This bill is identical to HB 178.

Consumer Data Protection Act; prohibitions and duties relating to minors. Prohibits a controller of an online service, product, or feature from entering into certain agreements with a known minor, unless such controller obtains verified consent from the minor's parent as specified in the bill. The bill imposes certain duties on a controller of an online service, product, or feature related to advertising, algorithm use, and reasonable care toward known minors. The bill expands the consumer rights of a parent to minors and adds a provision allowing a parent to obtain a copy of the minor's data. Current law offers certain consumer rights to the parents of children younger than age 13. The bill has a delayed effective date of January 1, 2027.

Surveillance pricing; prohibited; civil penalties. Prohibits the use of surveillance pricing in connection with a consumer transaction. The bill defines "surveillance pricing" as the selling or offering for sale of a good or service at a customized price for a specific consumer or group of consumers that is based, in whole or in part, on personal data that is collected through electronic surveillance technology, regardless of whether the seller collected or purchased the personal data. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act.

Consumer Data Protection Act; protections for children; definitions. Requires a controller or processor, as such terms are defined in relevant law, to obtain verifiable parental consent, defined in the bill, prior to registering any child younger than 18 years of age with the controller's or processor's product or service or before collecting, using, or disclosing such child's personal data.

Employment decisions; automated decision systems; civil penalty. Provides that the Director of the Department of Human Resource Management shall require any state agency that uses an automated decision system as a substantial factor in any employment decision, as those terms are defined in the bill, to (i) ensure that such system and the use of such system complies with federal and state law, (ii) make certain disclosures, (iii) provide an opt-out mechanism, (iv) annually test such system, (v) ensure data security, and (vi) train agency staff on such system. The bill requires the Department and local government employers to establish and publicize a process for applicants for employment and employees to file concerns and complaints regarding the use of automated decision systems in such employment decisions and a process for the investigation and resolution of any such concerns and complaints. The bill also provides that no final employment decision shall be made by an employer without the involvement of a human decision maker, and no employer shall solely use any recommendation or prediction from an automated decision system to make a final employment decision. The bill subjects violating employers to civil penalties.