United States of America: Bill amending Consumer Data Protection Act (SB 201) introduced to Senate of Virginia

On 14 January 2026, the Bill amending the Consumer Data Protection Act (SB 201) was introduced to the General Assembly of Virginia. The Bill mandates that controllers and processors obtain verifiable parental consent before registering a user under 18 for a service or collecting, using, or disclosing that user’s personal data. The Bill requires that parents or guardians be provided with the option to consent to data collection and use without necessarily agreeing to the disclosure of information to third parties. Furthermore, the Bill outlines specific methods for obtaining verifiable consent, including the use of signed forms, credit or debit card transactions with account holder notification, and the provision of valid government-issued identification. The Bill also establishes updated definitions of “verifiable parental consent” and “parent or guardian” applicable to social media platforms and online services, to clarify the scope of these requirements, while maintaining certain exemptions for entities already compliant with the federal Children’s Online Privacy Protection Act.