SB 783 would amend Virginia’s Consumer Data Protection Act to add specific protections for children. The bill expands the definition of “child” from under 13 to under 18 for purposes of the act’s new parental-consent requirements, and it adds a new section requiring controllers and processors to obtain verifiable parental consent before registering a child for a product or service or before collecting, using, or disclosing a child’s personal data that has been verified by a parent or guardian. It also requires that parents or guardians be given the option to consent to collection and use of the child’s data without consenting to disclosure of that data to third parties.
The bill further specifies how verifiable parental consent may be obtained, including by signed form, payment-card verification, or government-issued identification, and directs businesses to make reasonable efforts using available technology to confirm the consenting adult is actually the child’s parent or guardian. It also clarifies that entities already complying with the federal Children’s Online Privacy Protection Act are deemed compliant with the bill’s parental-consent obligations. In addition, the bill updates definitions and scope provisions within the Consumer Data Protection Act, including terms related to personal data, sensitive data, targeted advertising, and exemptions for certain regulated entities and categories of data.
If enacted, SB 783 would change Virginia law by imposing additional privacy compliance obligations on businesses that conduct business in Virginia or target Virginia residents and meet the act’s size thresholds. The practical effect would be to increase restrictions on the collection, use, and disclosure of minors’ data, especially for online services, apps, and other digital products that register users or process personal information. It would also reinforce existing exemptions for government entities, nonprofits, higher education institutions, and various federally regulated data categories such as HIPAA-covered information, FCRA data, FERPA data, and other protected records.
The general sentiment reflected in the available voting history appears mixed to cautious. The bill was reported out of the Senate General Laws and Technology Committee by an 8-6 vote with one abstention, indicating meaningful support but also substantial opposition. Because there are no transcript excerpts, the record does not show detailed debate, but the close committee vote suggests the proposal was viewed as significant and potentially burdensome by some members while others supported stronger child privacy protections.
The main point of contention is likely the scope of the parental-consent requirement, especially the expansion of “child” to include anyone under 18 rather than the more common under-13 standard used in federal children’s privacy law. That broader age threshold could affect a much larger set of online services and raise compliance and implementation concerns for businesses. Another likely issue is the balance between protecting minors’ data and preserving access to digital services, particularly where parental verification methods and third-party disclosure restrictions may be operationally difficult for controllers and processors to administer.
The bill would amend the Virginia Consumer Data Protection Act by revising definitions and adding a new child-specific consent provision, thereby increasing privacy obligations for covered businesses that process personal data of Virginia residents. It would require verifiable parental consent for registering children or processing verified child data, while preserving existing exemptions for government, nonprofits, higher education, and federally regulated data categories. It would also align part of Virginia law with COPPA compliance by treating businesses already compliant with federal parental-consent rules as compliant under the state act.
Available voting history suggests the bill generated divided but not overwhelming support. The 8-6 committee vote to pass it by indefinitely indicates that a majority of the committee favored advancing it, but a substantial minority opposed it. With no transcript available, the overall sentiment can only be characterized as mixed, with support centered on child privacy protections and opposition likely tied to compliance burden and scope concerns.
The most notable contention is the bill’s expansion of child privacy protections to individuals under 18, which is broader than many existing privacy frameworks and could significantly expand regulated activity. Opponents are likely concerned about the administrative burden of verifying parental consent, the feasibility of age-based compliance online, and the impact on digital services and targeted advertising. Supporters are likely focused on stronger protections for minors’ personal data, especially around collection, use, and third-party disclosure.