A BILL to amend the Code of Virginia by adding a section numbered 59.1-577.2, relating to Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data.
HB654 would add a new section to Virginia’s Consumer Data Protection Act requiring consent before a controller, processor, or affiliate may process certain biometric information. The bill specifically covers facial data, including facial mapping, facial geometry, facial templates, and data derived from photographs or video recordings, as well as data related to a consumer’s eye retinas or irises. For known children, the bill requires that such processing comply with the federal Children’s Online Privacy Protection Act (COPPA) rather than relying on general consent alone.
The bill also creates limited carveouts. It would not apply to air carriers, and it would not be enforced where a federal law or agreement expressly preempts it, including in areas involving national security or health care. In practical terms, the measure would expand privacy protections for Virginians by restricting the collection and use of sensitive biometric identifiers unless the consumer consents or a child-specific federal standard is met.
If enacted, HB654 would amend Title 59.1 of the Code of Virginia by adding § 59.1-577.2 to the Consumer Data Protection Act. It would impose new compliance obligations on businesses and other entities that process facial recognition-related data or iris/retina data, requiring consent and aligning child-related processing with COPPA. The bill would affect controllers, processors, and their affiliates, while preserving existing statutory exemptions and limiting application where federal law preempts state regulation.
The available record shows no committee transcript, vote tally, or recorded floor debate, so there is no direct evidence of expressed support or opposition in the materials provided. The bill’s referral history indicates it was left in the House Committee on Communications, Technology and Innovation, suggesting it did not advance out of committee. Based on the text alone, the measure appears to be a privacy-protection bill aimed at limiting biometric surveillance and data use, with a narrow set of exceptions for federally regulated or preempted contexts.
The main points of potential contention are the scope of the consent requirement and the treatment of biometric technologies used by businesses, especially facial recognition systems. Privacy advocates would likely favor the bill’s restrictions, while technology companies, data processors, and other affected entities could object to added compliance burdens or uncertainty around what counts as facial data. The explicit exemptions for air carriers and federally preempted national security or health care activities suggest lawmakers anticipated conflicts with federal regulation and industry-specific uses of biometric data.