Virginia Children's Privacy Laws (2026)

SB 237 / HB 757 — App Store Accountability Act · SB 237 (companion HB 757), 2026 session

Pending — A bill was introduced this cycle but is not yet law. · App store · binds app stores, developers

Ages: Minors (under 18)

Requires: Would require app store providers to verify the age category (adult vs. minor) of an account holder at setup, obtain verifiable parental consent for a minor account holder before app downloads/purchases/in-app purchases, and share age-category and consent signals with app developers; enforceable by the Attorney General and via private action by a harmed minor or parent.

SB 854 — Consumer Data Protection Act; social media platforms, minors · SB 854 (2025)

Enacted — enjoined — Passed, but a court has currently blocked enforcement. · Social media · effective 2026-01-01 · binds platforms, operators

Ages: Under 16

Requires: Social media platform operators must use commercially reasonable methods (e.g., a neutral age screen) to determine whether a user is under 16; for identified under-16 users, must limit use of the platform to no more than one hour per day per service, unless a parent provides verifiable parental consent to raise or remove the limit. Age-determination data may not be used for other purposes; service quality/pricing may not be degraded due to the limits.

Litigation: NetChoice v. Jones (formerly NetChoice v. Miyares), No. 1:25-cv-02067, U.S. District Court for the Eastern District of Virginia. Preliminary injunction granted Feb 27, 2026 (Judge Patricia Tolliver Giles) blocking enforcement; court found the law content-based, applied strict scrutiny, and held it not narrowly tailored. Virginia appealed to the U.S. Court of Appeals for the Fourth Circuit (Mar 3, 2026); injunction still in effect as of 2026-06-27.

Consumer Data Protection Act; prohibitions and duties relating to minors · SB 232 (2026)

Pending — A bill was introduced this cycle but is not yet law. · Design code · binds operators

Ages: Known minors under 18

Requires: Would bar a controller of an online service, product, or feature from entering certain agreements with a known minor (under 18) without verified parental consent, and would impose a duty of reasonable care to avoid foreseeable harms to known minors (e.g., self-harm, bullying, sexual exploitation), plus limits on targeted advertising and on algorithmic/recommendation features directed at minors and a parental right to obtain a copy of the minor's data.

Virginia Consumer Data Protection Act — minors' provisions · SB 361 / HB 707 (Chapter 844, 2024)

In force — Effective and enforceable today. · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known child under 13 (processed per COPPA)

Requires: For a consumer the controller actually knows is a child (under 13), the VCDPA forbids processing that child's personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects, and forbids processing or retaining data beyond what is reasonably necessary, unless the controller first obtains parental consent in accordance with COPPA (Code of Va. § 59.1-578(F)). It also limits collection of a known child's precise geolocation data and requires a signal when such data is collected.

Litigation: Not challenged as to the children's-data provisions. The separate NetChoice v. Miyares / Virginia social-media one-hour-limit provisions (§ 59.1-577.1, out of scope here) were preliminarily enjoined Feb. 27, 2026 (E.D. Va., J. Giles); that injunction does not reach the § 59.1-578(F) known-child data duties, which remain in force.