WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
"Artificial intelligenceArtificial intelligence"Artificial intelligence" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets.Va. Code § 59.1-607" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets. "Artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.Va. Code § 59.1-607" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments. "DeveloperDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.Va. Code § 59.1-607 that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth. "Do Not Train dataDo Not Train data"Do Not Train data" means any data whose owner or publisher has affirmatively asserted that the data should not be used for training an artificial intelligence system.Va. Code § 59.1-607" means any data whose owner or publisher has affirmatively asserted that the data should not be used for training an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.Va. Code § 59.1-607. "Generative artificial intelligenceGenerative artificial intelligence"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.Va. Code § 59.1-607" means artificial intelligenceArtificial intelligence"Artificial intelligence" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets.Va. Code § 59.1-607 based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos. "Generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607" means any artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.Va. Code § 59.1-607 or service that incorporates generative artificial intelligenceGenerative artificial intelligence"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.Va. Code § 59.1-607. "Personal data" means the same as that term is defined in § 59.1-575. "PreprocessingPreprocessing"Preprocessing" means any cleaning, processing, or other modification of data prior to usage.Va. Code § 59.1-607" means any cleaning, processing, or other modification of data prior to usage. "Primary content ownerPrimary content owner"Primary content owner" means (i) a person, partnership, or company that owns, in full or in part, digital data, content, or objects that are subject to copyright protection or (ii) a natural person with personally identifiable information.Va. Code § 59.1-607" means (i) a person, partnership, or company that owns, in full or in part, digital data, content, or objects that are subject to copyright protection or (ii) a natural person with personally identifiable information. "Publicly available mechanismPublicly available mechanism"Publicly available mechanism" means a mechanism that is lawfully made available to the general public by a developer or other entity through wide distribution, unless the mechanism is restricted to a specific audience.Va. Code § 59.1-607" means a mechanism that is lawfully made available to the general public by a developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 or other entity through wide distribution, unless the mechanism is restricted to a specific audience. "Security or integritySecurity or integrity"Security or integrity" means the ability of (i) networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; (ii) businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions, and help prosecute those responsible for such actions; and (iii) businesses to ensure the physical safety of natural persons.Va. Code § 59.1-607" means the ability of (i) networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; (ii) businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions, and help prosecute those responsible for such actions; and (iii) businesses to ensure the physical safety of natural persons. "Significant updateSignificant update"Significant update" means any new version, new release, or other update to a generative artificial intelligence system or service that results in significant changes to such system's or service's use case or key functionality, including the results of retraining or fine-tuning.Va. Code § 59.1-607" means any new version, new release, or other update to a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607 that results in significant changes to such system's or service's use case or key functionality, including the results of retraining or fine-tuning. "Synthetic data generationSynthetic data generation"Synthetic data generation" means a process in which seed data are used to create artificial data by using a generative artificial intelligence system or service.Va. Code § 59.1-607" means a process in which seed data are used to create artificial data by using a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607. "Synthetic digital content" means any digital content, including any audio, image, text, or video, that is produced or manipulated by a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607, including a general-purpose artificial intelligenceArtificial intelligence"Artificial intelligence" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets.Va. Code § 59.1-607 model. "Train a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607" includes, in addition to initial data set training, further testing, validating, or fine-tuning by the developer of the generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607. "Training Data Deletion RequestTraining Data Deletion Request"Training Data Deletion Request" or "TDDR" means a mechanism by which a primary content owner submits a request to a developer to delete content that was or will be ingested by or included in a generative artificial intelligence training data set.Va. Code § 59.1-607" or "TDDR" means a mechanism by which a primary content ownerPrimary content owner"Primary content owner" means (i) a person, partnership, or company that owns, in full or in part, digital data, content, or objects that are subject to copyright protection or (ii) a natural person with personally identifiable information.Va. Code § 59.1-607 submits a request to a developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 to delete content that was or will be ingested by or included in a generative artificial intelligenceGenerative artificial intelligence"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.Va. Code § 59.1-607 training data set. "Training Data Verification RequestTraining Data Verification Request"Training Data Verification Request" or "TDVR" means a mechanism by which a primary content owner submits a request to a developer to verify if the owner's content was ingested by or included in a generative artificial intelligence training data set.Va. Code § 59.1-607" or "TDVR" means a mechanism by which a primary content ownerPrimary content owner"Primary content owner" means (i) a person, partnership, or company that owns, in full or in part, digital data, content, or objects that are subject to copyright protection or (ii) a natural person with personally identifiable information.Va. Code § 59.1-607 submits a request to a developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 to verify if the owner's content was ingested by or included in a generative artificial intelligenceGenerative artificial intelligence"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.Va. Code § 59.1-607 training data set.
This section establishes the defined terms for the new Artificial Intelligence Training Data Transparency Act. Key terms include Developer (any person doing business in Virginia that develops or significantly updates an AI system offered to Virginia consumers), Generative artificial intelligence system or service (the covered platform), Primary content owner (copyright holders and individuals with PII who may exercise training data rights), and two novel request mechanisms: Training Data Verification Request (TDVR) and Training Data Deletion Request (TDDR). The concept of Do Not Train data is also defined, covering data whose owner has affirmatively opted out of AI training use.
(A) 1 A developer of a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607 that is made available in the Commonwealth for use, regardless of whether the terms of that use include compensation, shall post on the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607's website the following information about the generative artificial intelligenceGenerative artificial intelligence"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.Va. Code § 59.1-607 training data set used to train the generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607: 1. A description of each data set used in the development of such system or service, including: a. The name of the data set; b. The source or owner of the data set; c. The approximate amount of data included in the data set; d. A statement of whether the data set includes any data protected by copyright, trademark, or patent; e. A description of any steps taken to manage copyrighted, trademarked, or patented data, including whether the data set was purchased or licensed by the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 and whether such data set has been preprocessed to filter copyrighted, trademarked, or patented data; f. A statement of whether the data set includes any Do Not Train dataDo Not Train data"Do Not Train data" means any data whose owner or publisher has affirmatively asserted that the data should not be used for training an artificial intelligence system.Va. Code § 59.1-607; g. A description of any steps taken to manage Do Not Train dataDo Not Train data"Do Not Train data" means any data whose owner or publisher has affirmatively asserted that the data should not be used for training an artificial intelligence system.Va. Code § 59.1-607, including whether the data set was purchased or licensed by the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 and whether such data set has been preprocessed to filter Do Not Train dataDo Not Train data"Do Not Train data" means any data whose owner or publisher has affirmatively asserted that the data should not be used for training an artificial intelligence system.Va. Code § 59.1-607; h. A statement of whether the data set includes personal data; i. A description of any steps taken to manage personal data, including whether the data set has been preprocessed to filter personal data, whether individuals were given the opportunity to opt out of their data being used to train a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607, whether notice was given to individuals that their data was being used to train a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607, and whether personal data collected prior to an opt-out is included; j. A statement of whether the data set includes any illegal materials; k. A description of any steps taken to manage illegal materials, including whether the data set has been preprocessed to filter illegal materials; l. The time period during which the data in the data set was collected, including a notice if the data collection is ongoing; and m. A disclosure that the generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607 uses synthetic data generationSynthetic data generation"Synthetic data generation" means a process in which seed data are used to create artificial data by using a generative artificial intelligence system or service.Va. Code § 59.1-607 in its development. 2. The disclosures required by this chapter to the extent that they derive from the generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607 that is used during synthetic data generationSynthetic data generation"Synthetic data generation" means a process in which seed data are used to create artificial data by using a generative artificial intelligence system or service.Va. Code § 59.1-607.
(B) 1 A developer of a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607 shall publish the disclosures required by this section no later than 72 hours after such system or service is made available for use in the Commonwealth.
(C) 1 After a significant updateSignificant update"Significant update" means any new version, new release, or other update to a generative artificial intelligence system or service that results in significant changes to such system's or service's use case or key functionality, including the results of retraining or fine-tuning.Va. Code § 59.1-607 has been made to a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607, the developer of such system or service shall update the published disclosures required by this section no later than 72 hours after the updated system or service is made available for use in the Commonwealth.
(D) 1 No developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall be required to post documentation regarding the data used to train a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607 that has the sole purpose of ensuring security or integritySecurity or integrity"Security or integrity" means the ability of (i) networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; (ii) businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions, and help prosecute those responsible for such actions; and (iii) businesses to ensure the physical safety of natural persons.Va. Code § 59.1-607.
This section imposes the bill's core public disclosure obligation on developers of generative AI systems or services made available in Virginia. Developers must post on their website detailed documentation about each training dataset, covering dataset names, sources, volume, IP status (copyright, trademark, patent), handling of Do Not Train data, personal data management, illegal material screening, collection timeframes, and synthetic data generation use. When synthetic data generation is used, the developer must also disclose the provenance of the generative AI system used to create the synthetic data.
The disclosure must be published within 72 hours of making the system available and updated within 72 hours after each significant update. A narrow carve-out exempts systems whose sole purpose is ensuring security or integrity.
(A) 2 A developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall keep detailed records of the generative artificial intelligenceGenerative artificial intelligence"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.Va. Code § 59.1-607 data set used to train a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607. A developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall be deemed compliant with this subsection if the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 adheres to the latest version of the Artificial IntelligenceArtificial intelligence"Artificial intelligence" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets.Va. Code § 59.1-607 Risk Management Framework published by the National Institute of Standards and Technology, Standard ISO/IEC 42001 of the International Organization for Standardization, or another nationally or internationally recognized risk management framework for artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.Va. Code § 59.1-607 or parts thereof.
(B) 3 A developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall provide a clearly designated and publicly available mechanismPublicly available mechanism"Publicly available mechanism" means a mechanism that is lawfully made available to the general public by a developer or other entity through wide distribution, unless the mechanism is restricted to a specific audience.Va. Code § 59.1-607 for the submission of Training Data Verification RequestsTraining Data Verification Request"Training Data Verification Request" or "TDVR" means a mechanism by which a primary content owner submits a request to a developer to verify if the owner's content was ingested by or included in a generative artificial intelligence training data set.Va. Code § 59.1-607 and shall provide verification pursuant to a TDVR within 30 days of receiving such a request.
(C) 4 A developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall provide a clearly designated and publicly available mechanismPublicly available mechanism"Publicly available mechanism" means a mechanism that is lawfully made available to the general public by a developer or other entity through wide distribution, unless the mechanism is restricted to a specific audience.Va. Code § 59.1-607 for the submission of Training Data Deletion RequestsTraining Data Deletion Request"Training Data Deletion Request" or "TDDR" means a mechanism by which a primary content owner submits a request to a developer to delete content that was or will be ingested by or included in a generative artificial intelligence training data set.Va. Code § 59.1-607 and shall delete content pursuant to a TDDR within 30 days of receiving such a request. A developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall delete content pursuant to a TDDR for all future versions of a generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607.
This section imposes three distinct operational duties on developers. First, developers must maintain detailed records of training datasets; compliance is deemed satisfied by adherence to the NIST AI RMF, ISO/IEC 42001, or another nationally or internationally recognized AI risk management framework. Second, developers must provide a publicly available mechanism for primary content owners to submit Training Data Verification Requests and must respond within 30 days. Third, developers must provide a publicly available mechanism for Training Data Deletion Requests and must delete the content within 30 days, including from all future versions of the system.
(A)–(B) 5 A. No developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 shall require an employee or a prospective employee to execute or renew any provision in a nondisclosure or confidentiality agreement, including any provision relating to nondisparagement, that has the purpose or effect of concealing the details relating to a claim of noncompliance with this chapter. Any such provision is against public policy and is void and unenforceable. B. This section shall in no way limit other grounds that exist at law or in equity for the unenforceability of any such agreement or any provision of such agreement.
This section prohibits developers from requiring employees or prospective employees to execute NDA or confidentiality provisions — including nondisparagement clauses — that would conceal noncompliance with the Training Data Transparency Act. Any such provision is declared void and unenforceable as against public policy. This is functionally an anti-retaliation and whistleblower-adjacent protection focused on transparency rather than safety disclosures.
(A) Any violation of this chapter shall constitute a prohibited practice under the provisions of § 59.1-200 and shall be subject to the enforcement provisions of the Virginia Consumer Protection Act (§ 59.1-196 et seq.).
(B) 1. Prior to initiating an enforcement action for a violation of this chapter, the Attorney General may provide a developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated. If within the 30-day period the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607. 2. The Attorney General, in determining whether to grant a developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 the opportunity to cure an alleged violation of this chapter, shall give due consideration to: a. The developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607's history of previous violations of this chapter; b. The size and complexity of the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607; c. The nature and complexity of the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607's generative artificial intelligence system or serviceGenerative artificial intelligence system or service"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.Va. Code § 59.1-607; d. The substantial likelihood of injury to the public as a result of the alleged violation; e. The safety of persons or property after the alleged violation; f. Whether the alleged violation was likely caused by human or technical error; and g. The demonstrated good faith of the developerDeveloper"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.Va. Code § 59.1-607 in attempting to achieve compliance with this chapter.
(C) Any person or entity claiming to be injured due to a violation of this chapter shall be entitled to initiate an action to recover monetary damages pursuant to § 59.1-204 or to obtain injunctive or any other available equitable relief. In granting equitable relief, the court may award reasonable attorney fees and costs to the person or entity injured.
This section establishes the enforcement framework for the Training Data Transparency Act. Violations constitute prohibited practices under the Virginia Consumer Protection Act (§ 59.1-200). The Attorney General may — but is not required to — provide a 30-day cure notice before initiating enforcement, with discretion guided by factors including violation history, developer size, public injury likelihood, and good faith. Notably, the section also creates a private right of action for any person or entity claiming injury, entitling them to monetary damages under § 59.1-204 or injunctive and equitable relief, with attorney fees available.
A(83)/(84) Violating any provision of the Artificial IntelligenceArtificial intelligence"Artificial intelligence" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets.Va. Code § 59.1-607 Training Data Transparency Act (§ 59.1-607 et seq.).
This section amends Virginia's general consumer protection prohibited-practices list (§ 59.1-200) to add a new enumerated violation for any violation of the Artificial Intelligence Training Data Transparency Act (§ 59.1-607 et seq.). The amendment appears in both the currently effective version and the version effective July 1, 2025, adding subdivision 83 (current version) and subdivision 84 (July 2025 version). This cross-reference is the enforcement hook that subjects Training Data Transparency Act violations to the full Virginia Consumer Protection Act remedies.
"AdolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575" means any natural person that is at least 13 years of age but younger than 16 years of age.
This section amends the Virginia Consumer Data Protection Act definitions to add the term Adolescent (natural person at least 13 but younger than 16), broaden the definition of biometric data to include photos, video, and audio recordings when generated for the purpose of uniquely identifying a natural person, expand sale of personal data to include exchanges for other valuable consideration (not just monetary), and expand sensitive data to include mental or physical health conditions or diagnoses. These definitional amendments support the new adolescent-specific data protection provisions added in § 59.1-578.
(A)(5) 6 To opt out of the processing of personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A consumer may authorize a third party, acting on the consumer's behalf, to opt out of the processing of the consumer's personal data for the purposes described in this subdivision. Such authorization may be made using technology that indicates the consumer's intent to opt out, including a browser setting, browser extension, global device setting, or other user-selected universal opt-out mechanism. For the purposes of this subdivision, the user-selected universal opt-out mechanism shall: a. Not unfairly disadvantage a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575; b. Require the consumer to make an affirmative, freely given, and unambiguous choice to opt out of any processing of a consumer's personal data; c. Be easy to use by the average consumer; d. Be consistent with state and federal laws and regulations; and e. Allow the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 to accurately determine whether the consumer has made a legitimate request to opt out under this subdivision 5.
(B)(6)–(7) 6 6. If a consumer's decision to authorize a third party to act on his behalf to opt out of the processing of his personal data pursuant to subdivision A 5 conflicts with the consumer's existing privacy setting with a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or voluntary participation in a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575's bona fide loyalty, rewards, premium features, discounts, or club card program, the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 shall comply with the consumer's opt-out but may notify the consumer of the conflict and provide the consumer with the choice to confirm his preferred privacy setting. 7. If a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 charges a fee for the use of a user-selected universal opt-out mechanism as described in subdivision A 5, the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 shall inform a consumer attempting to use such mechanism of such fee.
This section amends the VCDPA consumer rights provision to add universal opt-out mechanism support. Consumers may now authorize a third party — using browser settings, browser extensions, global device settings, or other user-selected universal opt-out mechanisms — to opt out of processing on their behalf. The mechanism must not unfairly disadvantage a controller, must require affirmative consumer choice, be easy to use, comply with applicable law, and allow controllers to verify legitimacy. Additional provisions address conflicts between universal opt-out signals and existing consumer privacy preferences or loyalty programs, and require controllers to inform consumers of any fees associated with opt-out mechanisms.
(A)(5) 7 Not process sensitive data concerning a consumer, including an adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575 consumer, without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.).
(G)(1) 7 1. Subject to the consent requirement established by subdivision 3 and where a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 has actual knowledge or willfully disregards that a consumer is an adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575, no controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 shall process any personal data collected from such adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575: a. For the purposes of (i) targeted advertising, (ii) the sale of such personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer; b. Unless such processing is reasonably necessary to provide the online service, product, or feature; c. For any processing purpose other than the processing purpose that the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 disclosed at the time such controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 collected such personal data or that is reasonably necessary for and compatible with such disclosed purpose; or d. For longer than is reasonably necessary to provide the online service, product, or feature.
(G)(2) 7 2. Subject to the consent requirement established by subdivision 3 and where a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 has actual knowledge or willfully disregards that a consumer is an adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575, no controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 shall collect precise geolocation data from such adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575 unless (i) such precise geolocation data is reasonably necessary for the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 to provide an online service, product, or feature and, if such data is necessary to provide such online service, product, or feature, such controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 shall only collect such data for the time necessary to provide such online service, product, or feature and (ii) the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 provides to the adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575 a signal indicating that such controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 is collecting such precise geolocation data, which signal shall be available to such adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575 for the entire duration of such collection.
(G)(3) 7 3. No controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 shall engage in the activities described in subdivision 1 or 2 unless the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 obtains consent from the adolescentAdolescent"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.Va. Code § 59.1-575 consumer.
This section amends the VCDPA's controller responsibilities to extend the existing child data protections to adolescents (ages 13–15). Where a controller has actual knowledge or willfully disregards that a consumer is an adolescent, the controller is prohibited from processing adolescent personal data for targeted advertising, sale, or profiling for consequential decisions; processing beyond what is reasonably necessary; purpose-incompatible processing; or retention beyond what is necessary. Precise geolocation collection from adolescents is similarly restricted. Unlike the child provisions that require parental consent, the adolescent provisions require consent from the adolescent consumer directly. The section also clarifies that sensitive data protections apply to adolescents.
(B)–(C) B. Prior to initiating any action under this chapter, the Attorney General may provide a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated. If within the 30-day period the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor. C. The Attorney General, in determining whether to grant a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor the opportunity to cure an alleged violation of this chapter, shall give due consideration to: 1. The controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575's or processor's history of previous violations of this chapter; 2. The size and complexity of the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor; 3. The nature and extent of the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575's or processor's processing activities; 4. The substantial likelihood of injury to the public as a result of the alleged violation; 5. The safety of persons or property after the alleged violation; 6. Whether the alleged violation was likely caused by human or technical error; and 7. The demonstrated good faith of the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor in attempting to achieve compliance with this chapter.
(D) If a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processor violates this chapter, fails to cure a noticed violation within the cure period in subsection B, or breaches an express written statement provided to the Attorney General under that subsection, the Attorney General may initiate an action in the name of the Commonwealth and may seek an injunction to restrain any violations of this chapter and civil penalties of up to $7,500 for each violation under this chapter. All civil penalties, expenses, and attorney fees collected pursuant to this chapter shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.
(F) Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of this chapter or under any other law.
This section amends the VCDPA enforcement provision to convert the Attorney General's 30-day cure notice from mandatory to discretionary. Under the amended text, the AG may (rather than shall) provide a cure period, with discretion guided by enumerated factors: violation history, entity size and complexity, processing scope, public injury likelihood, safety impact, whether the violation was caused by error, and the entity's good faith compliance efforts. This change takes effect January 1, 2026.