On May 17, 2024, the Governor of Virginia approved House Bill 707 to amend the Virginia Consumer Data Protection Act (CDPA) in relation to protection for children (the Act). The Act will now take effect on January 1, 2025.

In particular, the Act introduces the requirements associated with the processing of children's data in specific circumstances, the uses of geolocation data, and the conducting of Data Protection Assessments (DPAs).

Processing of children's data

In particular, the Act prohibits data controllers from processing the personal data of a known child for:

• targeted advertising purposes;
• the sale of personal data or profiling which produces legal or similarly significant effects; or
• any purpose other than the purpose disclosed by the data controller at the time personal data was collected or that is reasonably necessary for and compatible with the disclosed purpose unless such processing is reasonably necessary to provide an online service, product, or feature.

In addition, the Act prohibits the processing of the personal data of a known child without first obtaining consent from the child's parent or legal guardian. The Act also prohibits data controllers from collecting precise geolocation data from a known child unless specific exceptions apply.

Data protection assessment

In regard to DPA, the Act establishes a requirement for data controllers who offer any online service, product, or feature to children to conduct DPAs that address the purpose of such an online service, product, or feature, the categories of known children's personal data that is being processed, and the purposes for which the controller processes known children's data.

You can read the Act here and view its legislative history here.