Virginia Children's Privacy Laws (2026)

SB 237 / HB 757: App Store Accountability Act · SB 237 (companion HB 757), 2026 session

Pending: A bill was introduced this cycle but is not yet law. · App store · binds app stores, developers

Ages: Minors (under 18)

Requires: Would require app store providers to verify the age category (adult vs. minor) of an account holder at setup, obtain verifiable parental consent for a minor account holder before app downloads/purchases/in-app purchases, and share age-category and consent signals with app developers; enforceable by the Attorney General and via private action by a harmed minor or parent. (Continued to the 2027 session by the Senate committee on 2026-02-04, with the House companion HB 757 continued on 2026-02-12; not passed in 2026, still pending.)

Entry last reviewed 2026-07-18

SB 854: Consumer Data Protection Act; social media platforms, minors · SB 854 (2025)

Enacted, enjoined: Passed, but a court has currently blocked enforcement. · Social media · effective 2026-01-01 · binds platforms, operators

Ages: Under 16

Requires: Social media platform operators must use commercially reasonable methods (e.g., a neutral age screen) to determine whether a user is under 16; for identified under-16 users, must limit use of the platform to no more than one hour per day per service, unless a parent provides verifiable parental consent to raise or remove the limit. Age-determination data may not be used for other purposes; service quality/pricing may not be degraded due to the limits.

Litigation: NetChoice v. Jones (formerly NetChoice v. Miyares), No. 1:25-cv-02067 (E.D. Va.), on appeal as No. 26-1252 (4th Cir.). Judge Patricia Tolliver Giles preliminarily enjoined enforcement of the social-media time-limit provisions (Va. Code § 59.1-577.1) on Feb 27, 2026 as content-based and not narrowly tailored; the Fourth Circuit denied Virginia's motion to stay the injunction pending appeal on Apr 10, 2026, and it remains in effect. Merits briefing closed with the Commonwealth's Jun 12, 2026 reply brief, and the Fourth Circuit tentatively calendared the appeal for oral argument during the Oct 27-30, 2026 argument session. The Commonwealth's renewed motion for a stay pending appeal and both sides' motions to expedite were briefed through a Jul 9, 2026 reply; no docket entry shows a ruling on them.

Entry last reviewed 2026-08-07

Consumer Data Protection Act; prohibitions and duties relating to minors · SB 232 (2026)

Pending: A bill was introduced this cycle but is not yet law. · Design code · binds operators

Ages: Known minors under 18

Requires: Would bar a controller of an online service, product, or feature from entering certain agreements with a known minor (under 18) without verified parental consent, and would impose a duty of reasonable care to avoid foreseeable harms to known minors (e.g., self-harm, bullying, sexual exploitation), plus limits on targeted advertising and on algorithmic/recommendation features directed at minors and a parental right to obtain a copy of the minor's data. (Continued to the 2027 session by the Senate committee on 2026-02-04; not passed in 2026, still pending.)

Entry last reviewed 2026-07-18

Virginia Consumer Data Protection Act: minors' provisions · SB 361 / HB 707 (Chapter 844, 2024)

In force: Effective and enforceable today. · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known child under 13 (processed per COPPA)

Requires: For a consumer the controller actually knows is a child (under 13), the VCDPA forbids processing that child's personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects, and forbids processing or retaining data beyond what is reasonably necessary, unless the controller first obtains parental consent in accordance with COPPA (Code of Va. § 59.1-578(F)). It also limits collection of a known child's precise geolocation data and requires a signal when such data is collected. Separately, 2026 Acts of Assembly c. 820 (SB 338, effective 2026-07-01) added § 59.1-578(A)(6), a flat ban on selling or offering to sell any consumer's precise geolocation data (a radius of 1,750 feet or less). That ban is not limited to minors, so a kids' wearable or family-location app cannot monetize Virginia location data at all. Precise geolocation remains sensitive data under § 59.1-575, so consent is still required to collect or process it, and for a known child that consent still runs through COPPA under subsection F; what changed is that consent no longer authorizes a sale. Note the VCDPA defines sale narrowly, as an exchange for monetary consideration only.

Litigation: Not challenged as to the children's-data provisions. The separate NetChoice v. Miyares / Virginia social-media one-hour-limit provisions (§ 59.1-577.1, out of scope here) were preliminarily enjoined Feb. 27, 2026 (E.D. Va., J. Giles); that injunction does not reach the § 59.1-578(F) known-child data duties, which remain in force.

Entry last reviewed 2026-07-18