Virginia Children’s Privacy Laws (2026)

SB 854 (2025)

Enacted, enjoined · Social media · effective 2026-01-01 · binds platforms, operators

Ages: Under 16

Requires: Social media platform operators must use commercially reasonable methods (e.g., a neutral age screen) to determine whether a user is under 16, and must treat a user as a minor whenever the user's device signals it, including through a browser plug-in, privacy or device setting, or other mechanism. For under-16 users they must limit use of the platform to one hour per day per service or application, and allow a parent to give verifiable parental consent to increase or decrease that daily limit. Age-determination data may not be used for anything other than age determination and age-appropriate experiences, and a platform may not withhold, degrade or raise the price of a service because of the limit.

Litigation: NetChoice v. Jones (formerly NetChoice v. Miyares), No. 1:25-cv-02067 (E.D. Va.), on appeal as No. 26-1252 (4th Cir.). Judge Patricia Tolliver Giles preliminarily enjoined enforcement of the social-media time-limit provisions (Va. Code § 59.1-577.1) on Feb 27, 2026 as content-based and not narrowly tailored; the Fourth Circuit denied Virginia's motion to stay the injunction pending appeal on Apr 10, 2026, and it remains in effect. Merits briefing closed with the Commonwealth's Jun 12, 2026 reply brief. The Fourth Circuit has since ruled on the outstanding motions and set a firm argument date: it granted the motion to expedite oral argument on 2026-07-16, DENIED the Commonwealth's renewed motion to stay the injunction pending appeal on 2026-08-24, and on 2026-08-27 calendared the appeal for argument on 2026-10-28 at 2:00 p.m., firming up its earlier tentative Oct 27-30 listing. The preliminary injunction remains in effect throughout.

Entry last reviewed 2026-10-01

SB 361 (Chapter 844) / HB 707 (Chapter 840), 2024

In force · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known child under 13 for the subsection F duties (processed per COPPA); all consumers for the § 59.1-578(A)(6) precise-geolocation sale ban

Requires: For a consumer the controller actually knows is a child (under 13), the VCDPA forbids processing that child's personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects, and forbids processing or retaining data beyond what is reasonably necessary, unless the controller first obtains parental consent in accordance with COPPA (Code of Va. § 59.1-578(F)). It also limits collection of a known child's precise geolocation data and requires a signal when such data is collected. Separately, 2026 Acts of Assembly c. 820 (SB 338, effective 2026-07-01) added § 59.1-578(A)(6), a flat ban on selling or offering to sell any consumer's precise geolocation data (a radius of 1,750 feet or less). That ban is not limited to minors, so a kids' wearable or family-location app cannot monetize Virginia location data at all. Precise geolocation remains sensitive data under § 59.1-575, so consent is still required to collect or process it, and for a known child that consent still runs through COPPA under subsection F; what changed is that consent no longer authorizes a sale. Note the VCDPA defines sale narrowly, as an exchange for monetary consideration only.

Litigation: No challenge to the § 59.1-578(F) known-child duties or to the c. 820 precise-geolocation sale ban identified in RECAP searches of the Virginia federal courts and the Fourth Circuit or on NetChoice's and CCIA's litigation pages. NetChoice's page lists one Virginia matter, NetChoice v. Jones (formerly NetChoice v. Miyares), No. 1:25-cv-02067 (E.D. Va.), which concerns the separate social-media one-hour-limit provisions (§ 59.1-577.1, out of scope here), preliminarily enjoined 2026-02-27 by Judge Giles; that injunction does not reach § 59.1-578, so the known-child duties and the geolocation sale ban remain in force.

Entry last reviewed 2026-10-01

SB 796 (2026 Regular Session; Senate-engrossed floor substitute, continued to the 2027 Session); would add Va. Code §§ 59.1-614 through 59.1-618

Pending · AI companion · binds operators

Ages: All users, age neutral: the not-human disclaimer and pop-up duties bind every operator, and the safety-system and incident duties bind covered entities (500,000 or more monthly active users worldwide); 'minor' (under 18) appears only in the definitions and in the parent's right to sue

AI chatbot access for minors: Safeguards only (proposed in a pending bill, not law).

Requires: Would require every chatbot operator to show users of all ages a static, persistent disclaimer that the chatbot is not human, plus a pop-up notice at login, every 30 minutes of sustained engagement, when the user asks, and when the user seeks advice in a licensed field such as medical, financial or legal advice; 'chatbot' covers any generative, open-ended, multi-turn conversational system, not only companion bots. Covered entities (500,000 or more monthly active users worldwide, excluding non-public tools and customer-service bots) would also need reasonable systems to detect and reduce users' emotional dependence, keep the chatbot from claiming to be human, and show a crisis message to users expressing suicidal thoughts, self-harm intent or an acute mental health crisis; they would have to try to alert emergency services or law enforcement within 24 hours of learning a user faces imminent risk of death or serious physical injury, and report incidents of death, suicide attempts or other serious harm linked to the chatbot to the Attorney General within 15 days. Enforcement would be by the Attorney General (injunctions and civil penalties up to $50,000 per violation by a covered entity, each day a separate violation) and by civil suit from any person harmed or the parent of a harmed minor, with punitive damages for willful, reckless or grossly negligent violations; contract waivers and arbitration clauses would be void. Despite the title, the Senate-passed text has no minor-specific duty: the introduced bill's 18+ age verification for companion chatbots was dropped in the Senate.

Litigation: None; not enacted. Passed the Senate 39-1 on 2026-02-17 as Sen. Durant's floor substitute, as amended. In the House it was referred to Communications, Technology and Innovation, where a committee substitute was offered and the committee continued the bill to the 2027 Session by voice vote on 2026-03-02; LIS records it as continued from last session on 2026-07-21. It has not passed the House.

Entry last reviewed 2026-10-01