Consumer Data Protection Act; social media, parental consent.
Summary
HB1817 amends Virginia’s Consumer Data Protection Act to create a specific parental-consent regime for social media platforms. The bill defines “social media platform” and requires platforms subject to the federal Children’s Online Privacy Protection Act to obtain verifiable parental consent before allowing any minor to create and use an account. It also gives parents or legal guardians the option to consent only to the collection and use of a minor’s personal data without consenting to disclosure of that data to third parties.
The bill also revises and expands several core definitions in the Consumer Data Protection Act, including personal data, sensitive data, targeted advertising, profiling, precise geolocation data, and sale of personal data. It adds a new section governing how social media platforms must verify parental consent, including acceptable methods such as signed forms, payment-card verification, or government-issued identification. The measure preserves existing exemptions for many categories of data and entities, including HIPAA-regulated information, financial institutions, nonprofits, higher education institutions, and certain employment-related data.
Impact
If enacted, HB1817 would modify Virginia’s consumer privacy framework by layering a new, platform-specific parental consent requirement onto the existing Consumer Data Protection Act. It would directly affect social media companies operating in Virginia, especially those already subject to COPPA, by requiring them to obtain verifiable parental consent before minors can create accounts and by limiting third-party disclosure unless separately authorized. The bill would also clarify and broaden statutory definitions that govern when data practices are covered, which could affect compliance obligations for controllers and processors handling sensitive data, targeted advertising, profiling, and geolocation information.
Sentiment
The available voting history suggests the bill faced skepticism in committee, as a subcommittee recommended passing it by indefinitely on a 6-4 vote. That result indicates there was meaningful support for the proposal, but not enough to advance it out of subcommittee. Because no committee transcript is available, the record does not show detailed public debate, but the vote pattern suggests the bill was controversial rather than broadly embraced.
Contention
The main point of contention appears to be whether Virginia should impose a special parental-consent requirement on social media platforms beyond existing federal COPPA rules and the broader state privacy framework. Supporters likely viewed the bill as a child-safety and parental-control measure, while opponents likely raised concerns about compliance burdens, overlap with federal law, and the practical difficulty of verifying parental identity online. Another likely area of dispute is the bill’s narrow focus on social media platforms, which could be seen as either appropriately targeted or as singling out one category of online service for special regulation.