VirginiaSB3382026 Regular SessionSenateWALLET

Consumer Data Protection Act; data controller responsibilities, precise geolocation data.

Sponsored By: Russet Perry (Democratic)

Signed by Governor

Summary

Consumer Data Protection Act; data controller responsibilities; precise geolocation data. Provides that, for purposes of the Consumer Data Protection Act, a controller of personal data shall not sell or offer for sale precise geolocation data concerning a consumer.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Bill Overview

Analyzed Economic Effects

4 provisions identified: 4 benefits, 0 costs, 0 mixed.

Clearer notices and easier privacy requests

Covered businesses must provide clear, accessible notices explaining what personal data they process, why, and how consumers exercise rights and appeal decisions. Notices must list the types of data shared and the types of third parties receiving it. Businesses selling personal data or using it for targeted ads must clearly disclose this and explain how to opt out. Notices must describe secure, reliable request methods that fit consumers’ usual interactions and allow identity checks. Businesses may require an existing account for identity checks, but cannot require a new account just to exercise privacy rights.

Protection when you use privacy rights

Covered businesses cannot deny goods or services, change prices, or change service quality because you use Virginia privacy rights. Allowed exceptions include different offers tied to opting out or voluntary loyalty, rewards, premium features, discount, or club programs. Businesses do not have to provide a product or service requiring data they do not collect or keep. Contract terms that waive or limit your statutory consumer privacy rights are void and unenforceable.

Stronger privacy protections for children’s data

For data collected from a known child, covered businesses face limits on targeted ads, sales, and profiling with major legal or similar effects. These uses require parent or legal guardian consent under federal children’s privacy law. They must also be reasonably needed to provide the online product, service, or feature, match disclosed purposes, and last only as long as needed. Businesses may collect a known child’s precise location only when reasonably needed to provide the online product, service, or feature. Collection requires the same parental consent, must last only as long as needed, and must show the child a signal throughout.

Stronger safeguards for your personal data

Under Virginia’s privacy law, covered businesses must limit collection to relevant personal data reasonably needed for purposes they disclose. Other uses require your consent unless reasonably necessary for, or compatible with, those purposes. Businesses must maintain reasonable staff, technology, and physical safeguards suited to the amount and type of data. They need consent to process sensitive data; sensitive data about a known child must follow federal children’s privacy law. They cannot sell or offer to sell your precise location data.

Sponsors & Cosponsors

Sponsor

  • Russet Perry

    Democratic • Senate

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 250 • No: 0

Senate vote • 3/2/2026

House Amendment agreed to by Senate

Yes: 40 • No: 0

House vote • 2/26/2026

Passed House with amendment

Yes: 96 • No: 0

House vote • 2/23/2026

Reported from Communications, Technology and Innovation with amendment(s)

Yes: 22 • No: 0

Senate vote • 2/3/2026

Read third time and passed Senate Block Vote

Yes: 39 • No: 0

Senate vote • 2/2/2026

Engrossed by Senate Block Vote (Voice Vote)

Yes: 0 • No: 0

Senate vote • 1/30/2026

Passed by for the day Block Vote (Voice Vote)

Yes: 0 • No: 0

Senate vote • 1/30/2026

Constitutional reading dispensed Block Vote (on 1st reading)

Yes: 38 • No: 0

Senate vote • 1/28/2026

Reported from General Laws and Technology

Yes: 15 • No: 0

Actions Timeline

  1. Acts of Assembly Chapter text (CHAP0820)

    4/13/2026Governor
  2. Approved by Governor-Chapter 820 (effective 7/1/2026)

    4/13/2026Governor
  3. Governor's Action Deadline 11:59 p.m., April 13, 2026

    3/10/2026Governor
  4. Enrolled Bill communicated to Governor on March 10, 2026

    3/10/2026Senate
  5. Fiscal Impact Statement from Department of Planning and Budget (SB338)

    3/5/2026Senate
  6. Bill text as passed Senate and House (SB338ER)

    3/5/2026Senate
  7. Enrolled

    3/5/2026Senate
  8. Signed by President

    3/5/2026Senate
  9. Signed by Speaker

    3/5/2026House
  10. Fiscal Impact Statement from Department of Planning and Budget (SB338)

    3/3/2026Senate
  11. House Amendment agreed to by Senate (40-Y 0-N 0-A)

    3/2/2026Senate
  12. Passed House with amendment (96-Y 0-N 0-A)

    2/26/2026House
  13. Engrossed by House as amended

    2/26/2026House
  14. committee amendment agreed to

    2/26/2026House
  15. Read third time

    2/26/2026House
  16. Read second time

    2/25/2026House
  17. Reported from Communications, Technology and Innovation with amendment(s) (22-Y 0-N)

    2/23/2026House
  18. Read first time

    2/6/2026House
  19. Referred to Committee on Communications, Technology and Innovation

    2/6/2026House
  20. Placed on Calendar

    2/6/2026House
  21. Read third time and passed Senate Block Vote (39-Y 0-N 0-A)

    2/3/2026Senate
  22. Engrossed by Senate Block Vote (Voice Vote)

    2/2/2026Senate
  23. Read second time

    2/2/2026Senate
  24. Passed by for the day Block Vote (Voice Vote)

    1/30/2026Senate
  25. Constitutional reading dispensed Block Vote (on 1st reading) (38-Y 0-N 0-A)

    1/30/2026Senate

Bill Text

Related Bills

Back to State Legislation