HB 4412 (2026), Child Online Protection and Liability Act

Criminal exposureNo

Private right of actionYes

Penalties

Private civil action for $10,000 per incident plus attorney fees and actual damages; Attorney General civil penalties of $10,000 per day of violation, $10,000 per instance of improper data retention, and up to $250,000 additional if a minor accesses the material.

Penalty structure

Court-assessed civil penalty of $10,000 per day the entity operates a noncompliant website, plus $10,000 per instance of improper retention of identifying information (Sec. 49A-1-102(b)), plus, if a minor accessed the material because of the violation, an additional amount of not more than $250,000. The $250,000 is an additional amount, not an aggregate cap on the daily penalty. Amount set considering seriousness, prior violations, deterrence, and economic effect.

Rule

Per violation only

As of

2 September 2026

Currency

USD

Per violation unit

Day

Per violation amount

10,000

Over one month of continuous breach, USD 304,400.

Statutory damages

A minor child, parent, guardian, or other authorized person harmed by a violation of the age-verification duty (Sec. 104(a)) or the no-retention duty (Sec. 104(c)) is entitled to $10,000 per incident of violation, plus reasonable attorney fees, court costs, and actual damages for financial, physical, and emotional harm shown to be a direct consequence of the violation.

As of

2 September 2026

Currency

USD

Per person minimum

10,000

Enforcement body

West Virginia Attorney General and private civil action.

Settledness

As of

17 October 2026

Open questions

• What makes a method that "relies on public or private transactional data" a "commercially reasonable method" of verifying age under W. Va. Code Section 49A-1-102(a)(2)(B)?
• May a commercial entity keep a record that an individual passed age verification, given that W. Va. Code Section 49A-1-102(b) bars retaining "any identifying information of the individual after access has been granted"?

Age threshold

18

Covered services

Websites or applications where sexual material harmful to minors is a substantial portion of content.

Obligation class

Age verification, Retention

Verification methods

Gov ID, Digital ID, Transactional data

Applicability criteria

As of

31 October 2026

Combinator

All of

Criteria

"Substantial portion" means more than 33.33% of total material on a website or application, which meets the definition of "sexual material harmful to minors" as defined in this section

Log retention

The bar does not reach data the entity or third party held before the age verification or holds apart from it, under the proviso to 102(b).

As of

28 October 2026

Basis

Purpose bound

Prohibits retaining

Identifying information of the individual whose age was verified, which neither the commercial entity nor a third party may retain after access has been granted to the material

Logging duty

Section 49A-1-102 requires a commercial entity or third-party verifier to require digital identification or a commercial or governmental age verification system, to comply with NIST best practices to limit the personally identifiable information transferred between entities (102(c)), and not to retain identifying information after access is granted (102(b)). It names no log, no record of the check, no retention period and no regulator access to a record. Section 49A-1-106(b) tells the Office of Technology to make rules on confirming receipt of verification information and on retaining, protecting and disposing of it, so any record or retention period would come from those rules, which are not part of the article's text.

Kind

None

As of

28 October 2026