On May 17, 2024, Virginia Governor Glenn Youngkin signed SB 361/HB 707 amending the Virginia Consumer Data Protection Act ("VCDPA") to impose additional requirements on controllers that process the personal data of a known "child"—i.e., a consumer who is under 13 years of age. The amendment, which is described in detail below, will become effective on January 1, 2025.

Parental Consent Required for Certain Processing Activities

Unless the controller first obtains parental consent, controllers are prohibited from processing personal data collected from a "known child" for the following purposes:

• targeted advertising,
• selling personal data, and
• profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

The amendment also prohibits controllers from processing personal data of known children:

• that is not reasonably necessary to provide the online service, product, or feature;
• for purposes other than those disclosed at the time the controller collected the personal data or that are reasonably necessary for and compatible with such disclosed purposes; and
• for longer than reasonably necessary to provide the online product, service, or feature.

The amendment also prohibits controllers from collecting a known child's precise geolocation data unless (1) such data is reasonably necessary to provide an online service, product, or feature, and then only for the time necessary to do so; and (2) the controller provides to the known child a signal—for the duration of collection—indicating that the controller is collecting precise geolocation data.

Controllers will be deemed compliant with the consent requirement if they adhere to the consent requirements in the Children's Online Privacy Protection Act.

Obligations for Controllers That Provide "Online Services, Products, or Features"

Several of the new obligations related to children's personal data apply to controllers that provide an "online service, product, or feature," which means simply "any service, product, or feature that is provided online." The amendment expressly carves out from the definition any telecommunications services, as defined in 47 U.S.C. § 153; broadband internet access services, as defined in 47 C.F.R. § 54.400; and delivery or use of a physical product.

In addition to imposing the above-mentioned restrictions on the scope and duration of processing of children's personal data and the collection of children's precise geolocation data, the amendment requires data protection assessments for any online services, products, or features that are "directed to consumers whom such controller has actual knowledge are children." Unlike other provisions in the amendment that apply to personal data collected from a "known child," this obligation applies to online services, products, and features "directed to" consumers whom the controller knows include children. Such data protection assessments must address the purpose of the online service, product, or feature; the categories of known children's personal data processed; and the purposes for which the controller processes known children's personal data with respect to the online service, product, or feature.

No Heightened Protection for Teens

Governor Youngkin had tried to include increased protections for consumers who were under 18 years of age, but the Virginia legislature declined to go that far. When he signed the bill, Governor Youngkin noted that "the bill does not go as far as it should, particularly by excluding minors over 13 from protection," and he committed to working "with the legislature and stakeholders to further strengthen these protections next session."

[View source.]