<p class=ldtitle>A BILL to amend and reenact §§ 59.1-575 and 59.1-576 of the Code of Virginia and to amend the Code of Virginia by adding a section numbered 59.1-577.2, relating to Consumer Data Protection Act; protections for children; definition of "child." </p>
Summary
SB201 would amend Virginia’s Consumer Data Protection Act to add a new child-focused privacy provision and to revise the Act’s definitions. The bill keeps the existing framework for covered businesses that collect or process personal data, but it adds a new section requiring controllers and processors to obtain verifiable parental consent before registering a child for a product or service or before collecting, using, or disclosing a child’s personal data. It also gives parents or guardians the option to consent to collection and use without consenting to disclosure of the child’s data to third parties.
The bill broadens the definition of “child” for this new section to mean any person under 18, while the general definitions section continues to define “child” as under 13 for other purposes in the chapter. It also specifies acceptable methods for obtaining verifiable parental consent, including a signed form, payment-card verification, or government-issued identification, and requires reasonable efforts based on available technology to confirm the consenting adult is the parent or guardian. In addition, the bill makes clear that controllers and processors complying with COPPA’s parental consent rules are deemed compliant with the chapter’s parental consent obligations.
Impact
If enacted, SB201 would modify Virginia’s data privacy law by imposing additional obligations on businesses that collect, use, disclose, or register minors’ data, especially online services and other data controllers/processors subject to the Consumer Data Protection Act. It would affect how companies verify parental authorization, structure child-facing products, and share children’s personal data with third parties. The bill would also create a broader child-protection standard for this section than the existing chapter definition, potentially increasing compliance burdens for covered entities operating in Virginia.
Sentiment
The bill appears to have been framed as a child privacy and online safety measure, with its core policy goal focused on strengthening parental control over children’s personal data. However, the committee vote shows it did not advance, failing to report on a 7-7 vote with one abstention in the General Laws and Technology Committee. That outcome suggests the proposal drew meaningful support but also substantial opposition or concern among committee members.
Contention
The main point of contention is likely the scope and mechanics of the parental consent requirement, including the expansion of “child” to under 18 for this section, the burden on businesses to verify parental identity, and the limits on data disclosure to third parties. Another likely issue is how the bill interacts with existing federal law, especially COPPA and HIPAA-related exemptions already built into the Consumer Data Protection Act. The split committee vote indicates disagreement over whether the added protections were necessary and workable or whether they would impose excessive compliance costs and operational complexity on covered businesses.