A BILL to amend and reenact § 59.1-584 of the Code of Virginia and to amend the Code of Virginia by adding a section numbered 59.1-584.1, relating to Consumer Data Protection Act; individual action for damages or penalty; social media platforms.
HB1368 would amend Virginia’s Consumer Data Protection Act to create a limited private right of action for parents or minors against controllers or processors that violate § 59.1-577.1, which appears aimed at social media platforms. Before filing suit, the parent or minor would have to give 30 days’ written notice and allow one opportunity to cure a substantially similar violation. If the violation is not cured, the bill would allow recovery of actual damages or $500 per violation, whichever is greater, with enhanced damages for willful violations up to three times actual damages or $1,000, whichever is greater.
The bill also preserves and clarifies the Attorney General’s enforcement authority under the Consumer Data Protection Act. It keeps the existing AG enforcement framework, including notice-and-cure procedures, civil penalties up to $7,500 per violation, and recovery of expenses and attorney fees, while expressly stating that the chapter does not create a private right of action except as provided in the new section for parents and minors. The new remedies would be cumulative and could include injunctive or declaratory relief, attorney fees, and court costs.
If enacted, HB1368 would significantly change enforcement of Virginia’s consumer privacy law by adding a targeted private enforcement mechanism for parents and minors involving social media-related violations. It would amend § 59.1-584 and add § 59.1-584.1, creating a new statutory cause of action, damages framework, and cure process, while leaving general enforcement by the Attorney General intact. The bill would affect controllers and processors subject to the Consumer Data Protection Act, especially social media platforms and services used by minors.
The available context suggests the bill did not advance out of the Communications, Technology and Innovation Committee, as it was left in committee and no votes or transcripts are provided. Based on the bill’s structure, the measure appears to reflect concern about privacy and online practices affecting children and parents, but there is no recorded committee debate here to show broader support or opposition. The absence of votes or discussion makes the overall sentiment difficult to gauge beyond its introduction and referral.
The main point of contention is likely the creation of a private right of action, which the bill otherwise denies for the Consumer Data Protection Act except for the new parent/minor remedy. Supporters would likely view the bill as giving families a direct enforcement tool against social media privacy violations, while opponents may object to increased litigation exposure, statutory damages, and the possibility of suits against platforms after only a single cure opportunity. Another likely issue is whether the bill’s targeted private remedy is too narrow or too broad, and whether enforcement should remain exclusively with the Attorney General.