Bill > SB232

This bill expands online consumer privacy protections in Virginia by introducing specific prohibitions and duties related to minors, who are defined as individuals under the age of 18, with the law taking effect on January 1, 2027. Under the legislation, online service, product, and feature providers (referred to as controllers) are generally prohibited from entering into terms of service agreements, user agreements, or account creation agreements with known minors unless they obtain verified consent from the minor's parent or legal guardian using approved methods such as signed forms, toll-free phone numbers, video calls, or government identification checks. When granting this verified consent, parents must be given tools to opt out of certain data collection and tracking practices, such as enabling high privacy settings, blocking precise geolocation tracking (data revealing a person's specific location within a 1,750-foot radius), and preventing targeted advertising (ads chosen based on a user's cross-site activity over time). Additionally, the bill broadens parental rights so that parents can request a comprehensive copy of all data a company holds on their minor child, including who the data was shared with and any profiling scores assigned to the minor. The legislation also places strict duties on online platforms regarding advertising and algorithms, requiring clear disclosures whenever ads are shown to minors and demanding transparency about how recommendation algorithms use minor data. Finally, the bill requires controllers to exercise reasonable care to prevent minors from being exposed to online harms such as self-harm, eating disorders, addiction-like usage patterns, bullying, sexual exploitation, unlawful product advertisements like alcohol and tobacco, and deceptive marketing practices.