summary
Introduced
01/13/2026
01/13/2026
In Committee
01/13/2026
01/13/2026
Crossed Over
Passed
Dead
Introduced Session
2026 Regular Regular Session
Bill Summary
Regulation of data brokers; civil penalties. Prohibits a person from acquiring personally identifiable information, defined in the bill, through fraudulent means or acquiring and using such information for the purpose of (i) stalking or harassing another person; (ii) committing a fraud, including identity theft, financial fraud, or email fraud; or (iii) engaging in unlawful discrimination, including employment discrimination or housing discrimination. The bill requires a data broker, defined in the bill, to develop, implement, and maintain a comprehensive information security program that includes certain features and technical elements. The bill also requires a data broker operating in the Commonwealth, beginning on December 1, 2027, and annually thereafter, to register with the Secretary of the Commonwealth. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act. The bill has a delayed effective date of July 1, 2027.
AI Summary
This bill, effective July 1, 2027, establishes regulations for "data brokers," which are defined as businesses that knowingly collect and sell personally identifiable information (PII) of consumers with whom they have no direct relationship, and whose primary revenue comes from such sales. The bill prohibits acquiring PII through fraudulent means or using it for stalking, harassment, fraud (like identity theft), or unlawful discrimination. It mandates that data brokers implement a comprehensive information security program, including administrative, technical, and physical safeguards, and requires them to register annually with the Secretary of the Commonwealth starting December 1, 2027, by paying a $1,000 fee and providing specific information about their data practices. Violations of these provisions are considered prohibited practices under the Virginia Consumer Protection Act, with the Attorney General having exclusive enforcement authority and the ability to seek injunctions and civil penalties of up to $7,500 per violation.
Committee Categories
Business and Industry
Sponsors (3)
Last Action
Continued to next session in Communications, Technology and Innovation (Voice Vote) (on 02/09/2026)
Official Document
bill text
bill summary
Loading...
bill summary
Loading...
bill summary
| Document Type | Source Location |
|---|---|
| State Bill Page | https://lis.virginia.gov/bill-details/20261/HB638 |
| BillText | https://lis.virginia.gov/bill-details/20261/HB638/text/HB638HC1 |
| BillText | https://lis.virginia.gov/bill-details/20261/HB638/text/HB638 |
Loading...