Virginia

Virginia's child pornography statute defines an identifiable minor to include a person whose image as a minor was used in creating, adapting, or modifying a visual depiction, recognizable by face, likeness, or other distinguishing characteristic, and its own text states that for this purpose the minor depicted does not have to actually exist, reaching a computer-generated or AI-manipulated depiction built from an identifiable real minor's likeness on the same terms as an unaltered photograph.

Section 18.2-374.1 punishes producing, financing, or knowingly taking part in producing such material, with penalties graduated by the subject's age and the offender's age relative to the subject; section 18.2-374.1:1 separately punishes knowing possession, and reproduction, sale, distribution, or solicitation to gain entry into a trading group.

The statute's history note lists amendments through 2024, but does not isolate which amendment year first added the 'does not have to actually exist' clause, so no commencement date for that specific text is confirmed here even though the statute as a whole is unquestionably in force today.

Any person who, with intent to coerce, harass, or intimidate, maliciously disseminates or sells a videographic or still image depicting another person nude, partially exposed, or (where not exposed) obscene, knowing or having reason to know they are not licensed or authorized to do so, is guilty of a Class 1 misdemeanor.

HB 2678 (2019), effective July 1, 2019, expanded 'another person' to include someone whose image was used in creating, adapting, or modifying a videographic or still image to depict an actual, recognizable person, reaching a falsely created or digitally manipulated (deepfake) image on the same terms as an unaltered photograph.

An internet, email, or other access-software provider is not liable under this section for content supplied by another person, and venue lies where the unlawful act occurs or where the image is produced, found, stored, or possessed.

An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to the Office of the Attorney General and any affected Virginia resident without unreasonable delay following discovery.

'Personal information' here (a Social Security, driver's license or state ID, passport, or military ID number, or a financial account number with an access code, each combined with a name) is narrower than VCDPA's 'personal data' and excludes information obtained from publicly available government records.

Unlike VCDPA, which bars a private plaintiff outright, this breach-notification chapter expressly preserves an individual's right to recover direct economic damages for a violation of the notification duty. This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

VCDPA governs private-sector processing of Virginia residents' personal data. Enacted in the 2021 Special Session I (cc. 35, 36), effective January 1, 2023. Controllers need a lawful basis for processing outside disclosed purposes and opt-in consent for sensitive data; controller duties are allocated at section 59.1-578 and processor duties, including a required data-processing contract, at section 59.1-579.

A 2026 amendment (S.B. 338, Ch. 820) added a ban on the sale of precise geolocation data, effective July 1, 2026 and already reflected in the codified text.

VCDPA gives a Virginia consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, exercisable against the controller.

A controller must respond without undue delay and within 45 days of receipt, with one 45-day extension available, and must answer an appeal of a denial within 60 days, with an option to escalate to the Attorney General.

The Virginia Attorney General has exclusive authority to enforce VCDPA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; this cure right carries no sunset date in the text, unlike several peer states'. The Attorney General may seek an injunction and civil penalties of up to $7,500 per violation. The chapter creates no private right of action.

VCDPA classifies the processing of genetic or biometric data to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring prior opt-in consent.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or eye retina or iris pattern, but the definition carries a blanket, unconditional exclusion for a photograph, video or audio recording, or data generated from either, with no clawback for data generated to identify someone.

A faceprint or voiceprint extracted from a recording for identification purposes therefore falls outside both biometric data and sensitive data under this Act.

Section 18.2-152.4(A) makes it unlawful for any person, with malicious intent or through intentionally deceptive means and without authority, to remove, disable, alter, damage, or otherwise interfere with computer data, programs, software, or operation.

Unlike a bare without-authorization standard (the Computer Fraud and Abuse Act (CFAA)'s, and most peer states' own statutes), this section requires malicious intent or intentionally deceptive means in addition to lack of authority, so ordinary unauthenticated, non-deceptive, non-malicious automated access to a public page that performs none of the listed disruptive acts does not fit the statute's elements at all, regardless of authorization; this makes Virginia's statute narrower and more scraping-favorable on its face than a pure authorization test, though no Virginia case law was found applying it to a scraping or automated-collection fact pattern specifically.

Subsection (C) expressly states the statute is not to be construed to interfere with or prohibit terms or conditions in a contract or license related to computers or computer services, preserving ordinary contract law as the separate track for ToS enforcement; no Virginia case addresses browsewrap versus clickwrap for a scraping dispute specifically.

VCDPA, the first comprehensive state consumer privacy law in the country, defines personal data to exclude de-identified data and publicly available information, meaning information lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted it to a specific audience; this reaches most scraped public personal data outside VCDPA's coverage at the definitional level.

Enforcement is by the Attorney General exclusively; the Act expressly states that nothing in it shall be construed as providing the basis for, or be subject to, a private right of action. This Act is sometimes cited as sections 59.1-571 to 59.1-585, which is wrong: section 59.1-571 is currently the definitions section of the unrelated Humane and Toxin-Free Cosmetics Act (Title 59.1, Chapter 52), and section 59.1-585 is a repealed placeholder.

VCDPA's actual current codification, confirmed directly against the official Virginia Law site, runs from section 59.1-575 (Chapter 53's own definitions section) to section 59.1-584 (its enforcement section).

In 2026, the General Assembly passed and Governor Spanberger signed SB 338 (signed April 13, 2026, effective July 1, 2026, per contemporaneous legal commentary), replacing VCDPA's prior consent-based treatment of precise geolocation as sensitive data with an outright ban on selling a consumer's precise geolocation data; the enrolled text of SB 338 is not reproduced in the official code copy cited here, so its effective date and exact mechanism rest on that commentary.

Commercial entities that knowingly publish or distribute material harmful to minors on websites containing a substantial portion (more than one third) of such material must verify that visitors are at least 18 years old using a commercially available age verification database or another commercially reasonable method.