Virginia's Children's Data Amendments: The 2024 Known-Child Rules, the One-Hour Social Media Limit and NetChoice v. Jones

Known Children Under the VCDPA

The Virginia Consumer Data Protection Act is chapter 53 of title 59.1, sections 59.1-575 through 59.1-584. Its definitions in section 59.1-575 fix a "child" as "any natural person younger than 13 years of age," and list "[t]he personal data collected from a known child" as one of four categories of sensitive data. The chapter does not define "known child" separately. Separate definitions of "parent" (a parent or legal guardian of a child or minor) and "online service, product, or feature" support the provisions described below.

Before 2024, the Act handled children in three places. Section 59.1-578(A)(5) prohibited processing a known child's sensitive data except "in accordance with the federal Children's Online Privacy Protection Act." Section 59.1-576(D) deems controllers and processors that comply with COPPA's verifiable parental consent requirements compliant with any parental consent obligation under the chapter. And section 59.1-577(A) lets a known child's parent or legal guardian invoke the consumer rights of access, correction, deletion, portability and opt-out on the child's behalf. The Act's applicability thresholds in section 59.1-576(A), 100,000 Virginia consumers, or 25,000 with more than half of gross revenue from selling personal data, apply to these provisions as to the rest of the chapter.

The 2024 Amendment and Verifiable Parental Consent

Two bills in the 2024 session amended the Act for children. According to the Legislative Information System records, HB 707 passed the House 98 to 0 and the Senate 39 to 0, and SB 361 passed the Senate 40 to 0 and the House 97 to 0. On April 8, 2024 the Governor returned each with a substitute; the House rejected his recommendation on HB 707 by 44 to 56 and the Senate rejected it on SB 361 by 19 to 21 on April 17. The Governor approved both bills as passed on May 17, 2024, as chapters 840 and 844 of the 2024 Acts of Assembly, each effective January 1, 2025.

The text of chapter 840 amended sections 59.1-575, 59.1-578 and 59.1-580. In section 59.1-575 it added the definition of "online service, product, or feature," which excludes telecommunications service, broadband Internet access service and the delivery or use of a physical product. In section 59.1-578 it added subsection F, which now reads as follows. Subject to the consent requirement, no controller may process personal data collected from a known child:

• For targeted advertising, the sale of the data, or profiling in furtherance of decisions that produce legal or similarly significant effects
• Unless the processing is reasonably necessary to provide the online service, product or feature
• For any purpose other than the one disclosed at collection or one reasonably necessary for and compatible with it
• For longer than is reasonably necessary to provide the online service, product or feature

Subdivision F 2 limits collection of a known child's precise geolocation data to what is reasonably necessary to provide the service, for only as long as necessary, and requires a signal to the child that collection is under way, "available to such known child for the entire duration of such collection." Subdivision F 3 states the condition attached to both: no controller engages in those activities "unless the controller obtains consent from the child's parent or legal guardian in accordance with the federal Children's Online Privacy Protection Act." The effect is that the activities listed in subsection F are prohibited outright unless that parental consent is obtained.

Section 59.1-578 has been amended once more since. Its history note cites chapter 820 of the 2026 Acts of Assembly, and the current text includes a subdivision A 6 that bars any controller from selling or offering for sale precise geolocation data concerning a consumer, whatever the consumer's age.

Data Protection Assessments for Child Users

Chapter 840 also added subsection B to section 59.1-580. A controller "that offers any online service, product, or feature directed to consumers whom such controller has actual knowledge are children" conducts a data protection assessment for that service covering three things: its purpose, the categories of known children's personal data it processes, and the purposes for which the controller processes that data.

The rest of the section applies to these assessments as to the others it requires. They weigh the benefits of the processing against the risks to consumers, factoring in de-identified data and consumers' reasonable expectations. The Attorney General may obtain one through a civil investigative demand, and an assessment produced that way is exempt from the Virginia Freedom of Information Act and does not waive attorney-client privilege or work product protection. Subsection G limits the requirement to processing activities created or generated after January 1, 2023.

The Social Media Time Limit for Minors Under 16

The second amendment came in 2025. SB 854 passed the Senate 40 to 0, was amended by a House floor substitute that passed 97 to 0, and the Senate agreed to the substitute 39 to 0. The Governor returned it with a recommendation on March 24, 2025, the Senate concurred 40 to 0 on April 2, and the Governor approved it on May 2, 2025 as chapter 703, effective January 1, 2026.

Chapter 703 added a definition of "social media platform" to section 59.1-575 and a new section 59.1-577.1. The section uses its own age line: a "minor" is any natural person younger than 16. A controller or processor that operates a social media platform must:

• Use commercially reasonable methods, such as a neutral age screen mechanism, to determine whether a user is a minor
• Limit a minor's use to one hour per day, per service or application, and allow a parent to give verifiable parental consent to increase or decrease the limit
• Use information collected to determine age only for age determination and age-appropriate experiences
• Treat a user as a minor if the user's device signals that the user is or should be treated as one, including through a browser plug-in, privacy setting or device setting

Subsection D provides that a parent who consents gets no additional access to or control over the minor's data or account, and subsection E bars withholding, degrading or charging more for a service because of the time limit. The platform definition requires a service that connects users to interact socially, lets them build a profile, populate a list of connections and post content. It excludes services consisting primarily of news, sports, entertainment, ecommerce or provider-preselected content where interactive functions are incidental, and services for interactive gaming.

Litigation Over the Time Limit

NetChoice, a trade association whose members include Meta, YouTube, Reddit and Dreamwidth, sued the Attorney General in the Eastern District of Virginia on November 17, 2025, case No. 1:25-cv-02067, and moved for a preliminary injunction four days later. After Jay Jones took office on January 17, 2026 he was substituted as defendant, and the case is now captioned NetChoice v. Jones. On February 16, 2026 his office announced that it intended to fully enforce the provision and had moved to dismiss the suit.

On February 27, 2026 Judge Patricia Tolliver Giles granted the motion. The memorandum opinion held that NetChoice had associational standing for its members and third-party standing for their users. On the merits, it found the platform definition content based, because it exempts news, sports, entertainment, ecommerce and interactive gaming and favors provider-selected content over user-generated content. Applying strict scrutiny, the court accepted that protecting children is a compelling interest but found the law likely not the least restrictive means, pointing to the age-verification burden on all users and to parental tools and other alternatives. It added that the law would likely fail intermediate scrutiny as well, describing it as both overinclusive and underinclusive, the latter because of the gaming exemption. The Commerce Clause claim was not reached.

The separate order enjoins the Attorney General and those under his supervision "from enforcing SB 854 against any NetChoice member by any means," including by suing for a violation of section 59.1-577.1(B). By its terms the injunction protects NetChoice members; it does not address platforms outside the association.

The Attorney General filed a notice of appeal on March 3, 2026, docketed in the Fourth Circuit as No. 26-1252. On April 10, 2026 a Fourth Circuit order denied his motion for a stay pending appeal because he had not first asked the district court, as Federal Rule of Appellate Procedure 8(a)(2)(A)(i) requires. On August 24, 2026 the court denied a renewed motion, with Judges Benjamin and Wilkinson in the majority and Judge Gregory voting to grant it. The district court case has continued in parallel, with discovery orders entered in July 2026. As of the latest filings retrieved for this article, the preliminary injunction remains in effect and the appeal has not been decided.

Attorney General Enforcement

All of these provisions are enforced under section 59.1-584, which gives the Attorney General exclusive authority. Before bringing an action, the office provides 30 days' written notice identifying the provisions allegedly violated, and if the controller or processor cures within that period and gives an express written statement that the violations are cured and will not recur, no action is initiated. If violations continue, or the written statement is breached, the Attorney General may seek an injunction and civil penalties of up to $7,500 for each violation, and may recover reasonable investigation expenses and attorney fees. Subsection E states that nothing in the chapter provides the basis for a private right of action.

The statute does not set a separate penalty or a different cure period for the children's provisions. The February 16, 2026 announcement described the sequence the office planned for section 59.1-577.1: notice of non-compliance, 30 days to remedy, and then enforcement actions seeking civil penalties of up to $7,500 per violation and injunctive relief. Since February 27, 2026, the injunction has barred that course as to NetChoice members.

Frequently Asked Questions