WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
"ChildChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575" means any natural person younger than 13 years of age.
"Verifiable parental consentVerifiable parental consent"Verifiable parental consent" means authorization by a parent or guardian for a controller or processor to register the child of such parent or guardian with such controller's or processor's product or service.Va. Code § 59.1-575" means authorization by a parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575 for a controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575 to register the child of such parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575 with such controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575's or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575's product or service.
"Parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575" means the same as that term is defined in § 59.1-519.
This section amends the existing VCDPA definitions in two key ways. First, it adds a new definition of "child" as any natural person younger than 13 — establishing a baseline definition for the chapter. Second, it adds a new defined term "verifiable parental consent" meaning authorization by a parent or guardian for a controller or processor to register the child with the entity's product or service. The definition of "parent or guardian" is also updated to cross-reference § 59.1-519 rather than using standalone language. The definition of "biometric data" receives a minor grammatical correction.
(D) (deleted) ControllersController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 and processorsProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575 that comply with the verifiable parental consentVerifiable parental consent"Verifiable parental consent" means authorization by a parent or guardian for a controller or processor to register the child of such parent or guardian with such controller's or processor's product or service.Va. Code § 59.1-575 requirements of the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) shall be deemed compliant with any obligation to obtain parental consentConsent"Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.Va. Code § 59.1-575 under this chapter.
This section amends the VCDPA's scope and exemptions provision by deleting subsection D, which previously provided that controllers and processors complying with the Children's Online Privacy Protection Act (COPPA) verifiable parental consent requirements would be deemed compliant with any obligation to obtain parental consent under the VCDPA. By removing this safe harbor, the bill ensures that the new verifiable parental consent obligation in § 59.1-577.2 cannot be satisfied merely by COPPA compliance — controllers must independently satisfy Virginia's consent requirements.
(A) For the purpose of this section, "childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575" means any natural person younger than 18 years of age.
(B) 1 A controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575 shall obtain verifiable parental consentVerifiable parental consent"Verifiable parental consent" means authorization by a parent or guardian for a controller or processor to register the child of such parent or guardian with such controller's or processor's product or service.Va. Code § 59.1-575 prior to registering any childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575 with the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575's or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575's product or service or before collecting, using, or disclosing such childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575's personal dataPersonal data"Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.Va. Code § 59.1-575 that has been verified by such childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575's parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575. A controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575 shall give the parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575 the option to consentConsent"Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.Va. Code § 59.1-575 to the collection and use of the childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575's personal dataPersonal data"Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.Va. Code § 59.1-575 without consenting to the disclosure of such childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575's personal dataPersonal data"Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.Va. Code § 59.1-575 to third parties.
(C) 2 A controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575 shall make reasonable efforts to obtain verifiable parental consentVerifiable parental consent"Verifiable parental consent" means authorization by a parent or guardian for a controller or processor to register the child of such parent or guardian with such controller's or processor's product or service.Va. Code § 59.1-575 by taking into consideration available technology to ensure that the person providing such consentConsent"Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.Va. Code § 59.1-575 is the childChild"Child" means any natural person younger than 13 years of age.Va. Code § 59.1-575's parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575. Verifiable parental consentVerifiable parental consent"Verifiable parental consent" means authorization by a parent or guardian for a controller or processor to register the child of such parent or guardian with such controller's or processor's product or service.Va. Code § 59.1-575 may be obtained from the parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575 by the parent or guardianParent or guardian"Parent or guardian" means the same as that term is defined in § 59.1-519.Va. Code § 59.1-575: 1. Providing a signed consentConsent"Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.Va. Code § 59.1-575 form to the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575; 2. Using a credit card, debit card, or other online payment system that provides notification of any transaction with the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575 to the primary account holder; or 3. Providing any valid government-issued identification to the controllerController"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.Va. Code § 59.1-575 or processorProcessor"Processor" means a natural or legal entity that processes personal data on behalf of a controller.Va. Code § 59.1-575.
This is the bill's operative section, creating a new verifiable parental consent regime for children's data. Critically, subsection A redefines "child" for this section only as any natural person younger than 18 — significantly broader than the chapter-wide definition of under 13 in § 59.1-575. This means the parental consent obligations apply to all minors, not just those under 13.
Subsection B imposes the core obligation: controllers and processors must obtain verifiable parental consent before registering any child with a product or service, or before collecting, using, or disclosing the child's personal data. Parents must also be given the granular option to consent to collection and use without consenting to third-party disclosure. Subsection C specifies acceptable methods for obtaining verifiable parental consent, including signed consent forms, credit/debit card transactions with account holder notification, or government-issued identification.