Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Virginia: Governor approves bill to amend CDPA to enhance children's protections

On May 17, 2024, the Governor of Virginia approved House Bill 707 to amend the Virginia Consumer Data Protection Act (CDPA) in relation to protection for children (the Act). The Act will now take effect on January 1, 2025.

In particular, the Act introduces the requirements associated with the processing of children's data in specific circumstances, the uses of geolocation data, and the conducting of Data Protection Assessments (DPAs).

Processing of children's data

In particular, the Act prohibits data controllers from processing the personal data of a known child for:

  • targeted advertising purposes;
  • the sale of personal data or profiling which produces legal or similarly significant effects; or
  • any purpose other than the purpose disclosed by the data controller at the time personal data was collected or that is reasonably necessary for and compatible with the disclosed purpose unless such processing is reasonably necessary to provide an online service, product, or feature.

In addition, the Act prohibits the processing of the personal data of a known child without first obtaining consent from the child's parent or legal guardian. The Act also prohibits data controllers from collecting precise geolocation data from a known child unless specific exceptions apply.

Data protection assessment

In regard to DPA, the Act establishes a requirement for data controllers who offer any online service, product, or feature to children to conduct DPAs that address the purpose of such an online service, product, or feature, the categories of known children's personal data that is being processed, and the purposes for which the controller processes known children's data.

You can read the Act here and view its legislative history here.