age
Virginia has required age verification for websites where a substantial portion of content is material harmful to minors since July 1, 2023, a law that predates and survived the 2025 U.S. Supreme Court ruling in Free Speech Coalition v. Paxton upholding similar state laws.
A 2025 law requiring social media platforms to screen for minors under 16 and cap their daily use at one hour was set to take effect January 1, 2026, but a federal court granted NetChoice a preliminary injunction in February 2026, and the state's appeal is pending at the Fourth Circuit. An App Store Accountability Act (SB 237, HB 757) was introduced in the 2026 General Assembly session but did not complete passage; HB 757 was continued to the next session in committee in February 2026. Virginia has not enacted a standalone age appropriate design code.
privacy
Virginia has no dedicated biometric statute; the Virginia Consumer Data Protection Act (VCDPA) is Virginia's comprehensive consumer-privacy regime, codified at Va. Code Ann. sections 59.1-575 to 59.1-585 (Title 59.1, Chapter 53), correcting an earlier seed citation that understated the range's low end at section 59.1-571. Effective January 1, 2023, it requires opt-in consent for sensitive data and gives consumers access, correction, deletion, portability, and opt-out rights.
Genetic and biometric data collected to uniquely identify a person is one of VCDPA's enumerated sensitive-data categories, so biometric data itself is a heightened category here, correcting an earlier reviewer pass that scored this attribute on a different question.
Within that category, VCDPA's biometric data definition separately carries a blanket exclusion for any data generated from a photograph, video, or audio recording, with no clawback for data generated to identify someone, so a faceprint or voiceprint extracted from a recording falls outside biometric data, and therefore outside sensitive data, entirely.
A separate chapter, Va. Code Ann. section 18.2-186.6, governs breach notification, and that chapter, unlike VCDPA itself, preserves an individual's right to recover direct economic damages for a violation of the notification duty. The VCDPA Attorney General has exclusive enforcement authority over the comprehensive act; there is no private right of action under VCDPA.
A 2026 amendment (S.B. 338) banned the sale of precise geolocation data, and separate minors' social-media provisions (section 59.1-577.1) are under a federal preliminary injunction: NetChoice v. Jones, No. 1:25-cv-2067 (PTG/LRV) (E.D. Va.), granted around February 27, 2026, with the Attorney General's appeal docketed at the Fourth Circuit on March 3, 2026.
This document does not add 59.1-577.1 as its own instrument because the underlying research pass did not independently verify the provision's text or the appeal's current posture against the court docket; the citation above was confirmed only from the court's own memorandum opinion and secondary reporting during review.
