Virginia

Virginia's child pornography statute defines an identifiable minor to include a person whose image as a minor was used in creating, adapting, or modifying a visual depiction, recognizable by face, likeness, or other distinguishing characteristic, and its own text states that for this purpose the minor depicted does not have to actually exist, reaching a computer-generated or AI-manipulated depiction built from an identifiable real minor's likeness on the same terms as an unaltered photograph.

Section 18.2-374.1 punishes producing, financing, or knowingly taking part in producing such material, with penalties graduated by the subject's age and the offender's age relative to the subject; section 18.2-374.1:1 separately punishes knowing possession, and reproduction, sale, distribution, or solicitation to gain entry into a trading group. The provisions this entry describes came into force on different days.

Any person who, with intent to coerce, harass, or intimidate, maliciously disseminates or sells a videographic or still image depicting another person nude, partially exposed, or (where not exposed) obscene, knowing or having reason to know they are not licensed or authorized to do so, is guilty of a Class 1 misdemeanor.

HB 2678 (2019), effective July 1, 2019, expanded 'another person' to include someone whose image was used in creating, adapting, or modifying a videographic or still image to depict an actual, recognizable person, reaching a falsely created or digitally manipulated (deepfake) image on the same terms as an unaltered photograph.

An internet, email, or other access-software provider is not liable under this section for content supplied by another person, and venue lies where the unlawful act occurs or where the image is produced, found, stored, or possessed.

Whenever any person requires another to furnish a fingerprint or fingerprints in conjunction with a business, commercial or financial transaction, unless the parties otherwise agree, the person must within 21 days of the transaction's completion or termination return or destroy the original record of the prints and all copies, including electronic or facsimile copies. The section does not apply to fingerprints affixed to instruments governed by Titles 8.3A and 8.4.

Chapter 715 of the 1999 Acts of Assembly numbered the section 59.1-480 in a new chapter 41 of Title 59.1. Chapter 715 of the 1999 Acts of Assembly took effect on July 1, 1999.

An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to the Office of the Attorney General and any affected Virginia resident without unreasonable delay following discovery.

'Personal information' here (a Social Security, driver's license or state ID, passport, or military ID number, or a financial account number with an access code, each combined with a name) is narrower than VCDPA's 'personal data' and excludes information obtained from publicly available government records.

Unlike VCDPA, which bars a private plaintiff outright, this breach-notification chapter provides that nothing in it limits an individual from recovering direct economic damages for a violation, and grants no cause of action of its own. The provisions this entry describes came into force on different days.

A licensee that learns that a cybersecurity event has or may have occurred must conduct, or have an investigator conduct, a prompt investigation. The investigation must at a minimum determine whether a cybersecurity event has occurred, assess its nature and scope, identify any nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information systems.

Where the event occurs in a system a third-party service provider maintains, the licensee must complete those steps or make reasonable efforts to confirm and document that the provider has completed them. Each licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon demand of the Commissioner.

A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of the Commonwealth. A licensee that has determined that a cybersecurity event has actually occurred must notify the Commissioner no later than three business days after the determination in the cases section 38.2-625(A) lists.

A licensee must notify affected consumers without unreasonable delay where nonpublic information was accessed and acquired by an unauthorized person and the event has a reasonable likelihood of causing or has caused identity theft or other fraud. A licensee that provides notice to more than 1,000 consumers at one time must also notify the nationwide consumer reporting agencies of the timing, distribution and content of the notice.

A licensee subject to Health Insurance Portability and Accountability Act (HIPAA) that has established and maintains an information security program under it, and that investigates a cybersecurity event and notifies consumers in accordance with HIPAA, is considered compliant with sections 38.2-624 and 38.2-626. The article does not create or imply a private cause of action for a violation of its provisions, and does not curtail one that would otherwise exist.

The Commissioner may examine and investigate the affairs of any licensee and take the action necessary or appropriate to enforce the article. The article and the rules adopted under it establish the exclusive state standards applicable to licensees for data security, the security of nonpublic information, and the investigation and notification of cybersecurity events.

Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation. The article took effect on July 1, 2020.

A controller must conduct and document a data protection assessment of processing for targeted advertising, the sale of personal data, certain profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers. A controller that offers an online service, product or feature directed to consumers it has actual knowledge are children must conduct a data protection assessment for it.

The Attorney General may request, pursuant to a civil investigative demand, that a controller disclose any data protection assessment relevant to an investigation, and the controller must make it available to the Attorney General. Data protection assessments are confidential and exempt from public inspection and copying under the Virginia Freedom of Information Act. The assessment requirements apply to processing activities created or generated after January 1, 2023, and are not retroactive.

VCDPA governs private-sector processing of Virginia residents' personal data. Enacted in the 2021 Special Session I (cc. 35, 36), effective January 1, 2023. Controllers need a lawful basis for processing outside disclosed purposes and opt-in consent for sensitive data; controller duties are allocated at section 59.1-578 and processor duties, including a required data-processing contract, at section 59.1-579.

A 2026 amendment (S.B. 338, Ch. 820) added a ban on the sale of precise geolocation data, effective July 1, 2026 and already reflected in the codified text.

The article binds insurance institutions, agents and insurance-support organizations that, for life or accident and sickness insurance, collect, receive or maintain information about Virginia residents or engage in transactions with Virginia residents, and, for property or casualty insurance, handle information about or engage in transactions on policies delivered, issued for delivery or renewed in the Commonwealth.

The article applies only to insurance purchased primarily for personal, family or household purposes. No insurance institution, agent or insurance-support organization may use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction, subject to an exception for investigating a claim. An insurance institution or agent must give every applicant or policyholder a notice of insurance information practices, at the times section 38.2-604 sets.

On a written request after proper identification, the holder must within 30 business days tell the individual the nature and substance of recorded personal information, let the individual see and copy it, disclose to whom it was disclosed within two years, and summarize the correction procedures.

Within 30 business days of a written request to correct, amend or delete recorded personal information, the holder must either do so or notify the individual of its refusal, the reasons and the right to file a statement. After an adverse underwriting decision, the insurance institution or agent responsible must give a written notice that provides the specific reasons or advises that they may be requested in writing, together with a summary of the individual's rights.

On a written request within 90 business days of the notice, the insurance institution or agent must furnish within 21 business days the specific reasons, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources.

An insurance institution, agent or insurance-support organization may not disclose medical-record information or privileged information about an individual collected or received in connection with an insurance transaction without the individual's written authorization.

A person proposing to issue accident and sickness insurance of the kind section 38.2-613(D) names may not disclose genetic information about an individual or a family member collected or received in connection with an insurance transaction unless the disclosure is made with the individual's written authorization. A person whose rights under sections 38.2-608, 38.2-609 or 38.2-610 are violated may apply to a court of competent jurisdiction for appropriate equitable relief.

An entity that discloses information in violation of section 38.2-613 is liable for the damages sustained by the individual, which may not exceed the actual damages. Except as section 38.2-617 specifically provides, there is no remedy or recovery for individuals, in law or in equity, for a violation of any provision of the article.

The State Corporation Commission may examine and investigate any insurance institution or agent doing business in the Commonwealth to determine whether it has engaged in conduct that violates the article. Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation.

A person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is fined not more than $10,000 or jailed for not more than 12 months, or both. Chapter 264 of the 2020 Acts of Assembly amended and reenacted sections 38.2-600, 38.2-601, 38.2-602, 38.2-612.1, 38.2-612.2, 38.2-613 and 38.2-614 through 38.2-618.

An insurance institution or agent must give clear and conspicuous notice of financial information collection and disclosure practices in connection with insurance transactions. A policyholder other than a policyholder of a title insurance policy must receive the notice not less than once in each calendar year.

No insurance institution, agent or insurance-support organization may disclose financial information about an individual to a nonaffiliated third party unless the individual has received notice, an opportunity of at least 30 days to direct that it not be disclosed, a reasonable means to do so, and the third party agrees not to disclose it further.

An insurance institution, agent or insurance-support organization may not disclose a policy number or similar access number or transaction account of a policyholder or applicant to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, subject to listed exceptions. No insurance institution or agent may unfairly discriminate against an individual because the individual has directed that personal information not be disclosed.

Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation. Chapter 371 of the 2001 Acts of Assembly added sections 38.2-513.1, 38.2-604.1, 38.2-612.1 and 38.2-612.2 to the Code of Virginia. Chapter 371 of the 2001 Acts of Assembly took effect on July 1, 2001. Section 38.2-612.1 was amended by Chapter 264 of the 2020 Acts of Assembly.

VCDPA gives a Virginia consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, exercisable against the controller.

A controller must respond without undue delay and within 45 days of receipt, with one 45-day extension available, and must answer an appeal of a denial within 60 days, with an option to escalate to the Attorney General.

The Virginia Attorney General has exclusive authority to enforce VCDPA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; this cure right carries no sunset date in the text, unlike several peer states'. The Attorney General may seek an injunction and civil penalties of up to $7,500 per violation. The chapter creates no private right of action.

No employer may request, require, solicit or administer a genetic test to any person as a condition of employment. No employer may refuse to hire, fail to promote, discharge or otherwise adversely affect the terms or conditions of employment of an employee or prospective employee solely on the basis of a genetic characteristic or the results of a genetic test, regardless of how the employer obtained the information or results.

Section 40.1-28.7:1 of the Code of Virginia does not preclude the use of information related to a criminal investigation. An employee may sue the employer that took adverse action within 180 days of the adverse action, and the court may award actual or punitive damages, including back pay with interest, or injunctive relief. The section does not require the Department of Labor and Industry to conduct any investigations or enforcement actions.

Section 40.1-28.7:1 of the Code of Virginia excludes any long term care, life or disability insurance policy from the terms and conditions of employment to which subdivision A 2 applies. Section 40.1-2.1 of the Code of Virginia provides that the provisions of Title 40.1 do not apply to the Commonwealth, its agencies, institutions or political subdivisions, or any public body, unless coverage is extended by specific regulation of the Commissioner or the Board. The section took effect on July 1, 2002.

Binds a direct-to-consumer genetic testing company, an entity that offers consumer-initiated genetic testing products or services directly to a consumer or collects, uses or analyzes genetic data collected or derived from such a product or service and directly provided by a consumer.

The chapter does not apply to protected health information collected, maintained, used or disclosed by a covered entity or business associate governed by the federal Health Insurance Portability and Accountability Act (HIPAA) privacy, security and breach notification rules.

A company must obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate express consent for the use of the data collected, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing.

On revocation of consent a company must honor the revocation within 30 days of receipt and destroy the consumer's biological sample within 30 days of receipt of revocation of consent to store it. A company must keep reasonable security procedures and practices and procedures that let a consumer access and delete the consumer's genetic data and request destruction of the biological sample.

A company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment without the consumer's express consent. Only the Attorney General may enforce the chapter. A violation carries a civil penalty of up to $1,000, and a willful violation a civil penalty of $1,000 to $10,000, each plus attorney fees, expenses and court costs. The chapter took effect on July 1, 2023.

A health care entity is any health care provider, health plan or health care clearinghouse. No health care entity, or other person working in a health care setting, may disclose an individual's health records except when the section or other provisions of state law permit or require it.

Within 30 days of receiving a request for copies of or electronic access to health records, the health care entity must furnish them, say that the information does not exist or cannot be found, name the entity that maintains it, or deny the request on a ground the section lists. A person to whom health records are disclosed may not redisclose them beyond the purpose of the disclosure without first obtaining the individual's specific authorization.

The section does not apply to the health records of minors except where it specifically provides, to information governed by the workers' compensation sections 65.2-604 and 65.2-607, or to releases of juvenile health records to a secure facility or of health records to a correctional facility. An individual who requests a copy of a health record may be charged only a reasonable cost-based fee covering supplies, copying labor, postage and the preparation of an agreed summary.

Section 32.1-27(A) of the Code of Virginia makes a willful violation of any provision of Title 32.1 a Class 1 misdemeanor unless a different penalty is specified. Section 32.1-27(B) of the Code of Virginia lets the Board of Health or the Commissioner compel a person violating any provision of Title 32.1 to comply by injunction, mandamus or other appropriate remedy in an appropriate court. The section took effect on July 1, 1997. The section's history note lists Chapter 248 of the 2026 Acts of Assembly as its most recent amending act.

No person proposing to issue, re-issue or renew an accident and sickness insurance policy, contract or plan, other than disability income insurance, of an insurer providing hospital, medical and surgical or major medical coverage on an expense incurred basis, a health services plan corporation or a health maintenance organization may use genetic information to restrict, cancel, refuse to renew or exclude coverage, impose a waiting period or rider, or set premium differentials.

Genetic information means information about genes, gene products, or inherited characteristics that may derive from an individual or a family member. An agent's or agency's fees or commissions may not be discriminated on the basis of a person's genetic characteristics that may be associated with disability in that person or that person's offspring.

Section 38.2-508.4(C) makes information obtained from genetic screening or testing conducted before the repeal of the section confidential and bars its use to cancel, refuse to issue or renew, or limit benefits under a covered policy, contract or plan.

The State Corporation Commission may examine and investigate each person subject to the chapter on unfair trade practices to determine whether the person has engaged in an unfair method of competition or an unfair or deceptive act or practice the chapter prohibits. Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation. The section took effect on July 1, 1996.

Except as otherwise specifically provided by law, a person may not intentionally communicate another individual's social security number to the general public, print it on a card required to access or receive products or services, require its use to access an Internet website without another authentication device, or send a mailing that displays it.

No person may embed an encrypted or unencrypted social security number in or on a card or document, including by a bar code, chip, magnetic strip or other technology, in place of removing it. The section does not prohibit the collection, use or release of a social security number as permitted by the laws of the Commonwealth or the United States, or its use for internal verification or administrative purposes unless a state or federal statute, rule or regulation prohibits that use.

Section 59.1-443.2(C) of the Code of Virginia made the prohibition on printing a social security number on a card required to access products or services effective on January 1, 2006 for a health care provider, a manager of a pharmacy benefit plan, an insurer, a corporation providing a health services plan, a health maintenance organization providing a health care plan, or a contractor of any of them. The section does not apply to public bodies.

A violation of section 59.1-443.2 is a prohibited practice under the Virginia Consumer Protection Act. On a finding of a willful violation under the Consumer Protection Act, the Attorney General or an attorney for the Commonwealth or a locality may recover a civil penalty of not more than $2,500 per violation. A person who suffers loss as the result of a violation of the Consumer Protection Act may recover actual damages or $500, whichever is greater.

Chapter 562 of the 2008 Acts of Assembly (Senate Bill 133), relating to access to social security numbers, amended and reenacted section 59.1-443.2. Chapter 820 of the 2008 Acts of Assembly (House Bill 633), relating to access to social security numbers, amended and reenacted section 59.1-443.2. The section took effect on July 1, 2005.

The Virginia Consumer Protection Act declares unlawful the listed fraudulent acts or practices committed by a supplier in connection with a consumer transaction. One listed practice is obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.

Reproductive or sexual health information includes efforts to research or obtain related services or supplies, including location information that may indicate an attempt to acquire them. It also includes information derived or extrapolated from non-health data by proxy, inference, or algorithm. The prohibition does not apply to nonpublic personal information subject to the Gramm-Leach-Bliley Act. The definition leaves out health information protected by Health Insurance Portability and Accountability Act (HIPAA). SB 754 was approved March 24, 2025, as Chapter 591 of the 2025 Acts of Assembly, effective July 1, 2025.

A school service is a website, mobile application or online service that is designed and marketed primarily for use in elementary or secondary schools, is used at the direction of school employees or by a school-affiliated entity, and collects and maintains, uses or shares student personal information. A school service provider is an entity that operates a school service under a contract with a local school division in the Commonwealth.

Each school service provider or school technology provider must provide clear information about the student personal information it collects, maintain a privacy policy, maintain a comprehensive information security program, and facilitate access to and correction of the information. Each provider must collect, maintain, use and share student personal information only with the consent of the student or, if under 18, the parent, or for the purposes the contract with the school division authorizes.

No provider may knowingly use or share student personal information for targeted advertising to students or sell it, except to a successor entity. A school service provider in operation on June 30, 2016 is not subject to the section until the contract to operate a school service is renewed. Chapter 728 of the 2015 Acts of Assembly added the section to Article 5 of Chapter 14 of Title 22.1 of the Code of Virginia. Chapter 728 of the 2015 Acts of Assembly took effect on July 1, 2015.

Chapter 438 of the 2016 Acts of Assembly (House Bill 749) amended and reenacted section 22.1-289.01, relating to school service providers. House Bill 749 of the 2016 Regular Session defined targeted advertising and clarified that the section does not prohibit school service providers from disclosing student personal information to ensure legal or regulatory compliance, protect against liability, or protect the security or integrity of the school service.

The enrolled text of House Bill 749 of 2016 changes the definition of a school service from one designed and marketed solely for use in elementary or secondary schools to one designed and marketed primarily for that use. Chapter 439 of the 2016 Acts of Assembly (House Bill 750) amended section 22.1-289.01 in relation to school services and college and career readiness assessment.

Chapter 468 of the 2016 Acts of Assembly (House Bill 519) amended section 22.1-289.01 in relation to school-affiliated entities. Chapter 518 of the 2017 Acts of Assembly (Senate Bill 951) amended section 22.1-289.01 in relation to student access to collected personal information. Chapter 364 of the 2025 Acts of Assembly (Senate Bill 1486) established requirements for the protection of student personal information on school-issued devices. Chapter 364 of the 2025 Acts of Assembly took effect on July 1, 2025.

VCDPA classifies the processing of genetic or biometric data to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring prior opt-in consent.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or eye retina or iris pattern, but the definition carries a blanket, unconditional exclusion for a photograph, video or audio recording, or data generated from either, with no clawback for data generated to identify someone.

A faceprint or voiceprint extracted from a recording for identification purposes therefore falls outside both biometric data and sensitive data under this Act.

Section 18.2-152.4(A) makes it unlawful for any person, with malicious intent or through intentionally deceptive means and without authority, to remove, disable, alter, damage, or otherwise interfere with computer data, programs, software, or operation.

The section applies to a person who acts with malicious intent, or through intentionally deceptive means and without authority, so ordinary unauthenticated, non-deceptive, non-malicious automated access to a public page that performs none of the listed disruptive acts does not fit the statute's elements at all, regardless of authorization; no Virginia case law was found applying it to a scraping or automated-collection fact pattern specifically.

Subsection (C) expressly states the statute is not to be construed to interfere with or prohibit terms or conditions in a contract or license related to computers or computer services, preserving ordinary contract law as the separate track for ToS enforcement; no Virginia case addresses browsewrap versus clickwrap for a scraping dispute specifically. No day on which the section came into force has been located.

Among the acts subsection A bars, subdivision A 8 lists installing or causing to be installed, or collecting information through, computer software that records all or a majority of the keystrokes made on the computer of another.

Among the acts subsection A bars, subdivision A 9 lists installing or causing to be installed on the computer of another computer software for the purpose of taking control of that computer so that it can cause damage to another computer, or disabling or disrupting the ability of the computer to share or transmit instructions or data to other computers or to related computer equipment or devices. If a person violates subdivision A 8 with malicious intent, the offense is a Class 6 felony.

The section is not to be construed to prohibit the monitoring of the computer usage of, the otherwise lawful copying of data of, or the denial of computer or Internet access to a minor by a parent or legal guardian of the minor.

VCDPA, the first comprehensive state consumer privacy law in the country, defines personal data to exclude de-identified data and publicly available information, meaning information lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted it to a specific audience; this reaches most scraped public personal data outside VCDPA's coverage at the definitional level.

Enforcement is by the Attorney General exclusively; the Act expressly states that nothing in it shall be construed as providing the basis for, or be subject to, a private right of action. This Act is sometimes cited as sections 59.1-571 to 59.1-585, which is wrong: section 59.1-571 is currently the definitions section of the unrelated Humane and Toxin-Free Cosmetics Act (Title 59.1, Chapter 52), and section 59.1-585 is a repealed placeholder.

VCDPA's actual current codification, confirmed directly against the official Virginia Law site, runs from section 59.1-575 (Chapter 53's own definitions section) to section 59.1-584 (its enforcement section).

In 2026, the General Assembly passed and Governor Spanberger signed SB 338 (signed April 13, 2026, effective July 1, 2026, per contemporaneous legal commentary), replacing VCDPA's prior consent-based treatment of precise geolocation as sensitive data with an outright ban on selling a consumer's precise geolocation data; the enrolled text of SB 338 is not reproduced in the official code copy cited here, so its effective date and exact mechanism rest on that commentary.

Each licensee must develop, implement, and maintain a comprehensive written information security program, based on its assessment of its risk, that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system.

Each licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.

Beginning July 1, 2022, a licensee that uses a third-party service provider must exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider.

Beginning in 2023, each insurer domiciled in the Commonwealth must submit to the Commissioner by February 15 each year a written statement certifying that it is in compliance with section 38.2-623, any rules adopted under the article, and any requirements prescribed by the Commission. A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have an investigator conduct one.

Each licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the event and produce those records upon demand of the Commissioner.

A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.

A licensee subject to Health Insurance Portability and Accountability Act (HIPAA) that maintains an information security program under it is considered to meet section 38.2-623 if it is compliant, submits a written statement certifying its compliance, and certifies that it will protect nonpublic information not subject to HIPAA in the same manner as information that is subject to HIPAA.

A licensee affiliated with a depository institution that maintains a program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information is considered to meet section 38.2-623 if it produces, on request, documentation satisfactory to the Commissioner that independently validates the depository institution's program.

Each licensee must conduct a periodic risk assessment that identifies reasonably foreseeable internal or external threats to nonpublic information, assesses the likelihood and potential damage of those threats, and assesses the sufficiency of the safeguards in place. An assessment conducted in accordance with the objectives of the most current revision of National Institute of Standards and Technology (NIST) SP 800-30, NIST SP 800-39, or another substantially similar standard meets the requirements for a periodic assessment.

Each licensee must implement appropriate security measures based on its risk assessments, including protecting by encryption or other appropriate means all nonpublic information while it is transmitted over an external network.

Effective July 1, 2022, a licensee that uses a third-party service provider must exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Compliance with the risk assessment requirement was required of all licensees on or before July 1, 2022.

The chapter sets out rules to carry out the Insurance Data Security Act and sets minimum standards for risk assessment and security standards required of all licensees. Section 14VAC5-430-50 derives from Virginia Register Volume 37, Issue 21, effective June 1, 2021, and was amended effective February 1, 2022.

Every public body must report all known incidents that threaten the security of the Commonwealth's data or communications or result in exposure of data protected by federal or state laws, and other incidents compromising the security of the public body's information technology systems with the potential to cause major disruption to normal activities of the public body or other public bodies.

Such reports must be made to the Virginia Fusion Intelligence Center within 24 hours from when the incident was discovered. The Virginia Fusion Intelligence Center shares such reports with the Chief Information Officer or the Chief Information Officer's designee at the Virginia Information Technologies Agency promptly upon receipt.

A public body means any legislative body, any court of the Commonwealth, any authority, board, bureau, commission, district, or agency of the Commonwealth, any political subdivision of the Commonwealth, and other organizations, corporations, or agencies in the Commonwealth supported wholly or principally by public funds.

No public body may use, directly or through work with or on behalf of another public body, any hardware, software, or services that have been prohibited by the United States Department of Homeland Security for use on federal systems.

Virginia law defines spam as unsolicited commercial electronic mail, excluding mail sent to a recipient with whom the sender has an existing business or personal relationship. Electronic mail an organization sends to its members is not spam for the civil action.

Sending spam is not itself an offense under this statute; using a computer or computer network with intent to falsify or forge electronic mail transmission or other routing information in connection with transmitting spam through or into an electronic mail service provider's network or its subscribers, or knowingly selling, giving, distributing or possessing with intent to distribute software primarily designed, of limited other commercial use, or marketed to enable that falsification, is a Class 1 misdemeanor.

The falsification offense becomes a Class 6 felony where the volume of spam transmitted exceeds 10,000 attempted recipients in 24 hours, 100,000 in 30 days, or 1,000,000 in a year, or where the revenue from a single transmission exceeds $1,000 or the total revenue from all spam sent to one electronic mail service provider exceeds $50,000, and knowingly using a minor to help transmit spam in such a felony is also a Class 6 felony.

A person injured by a violation may recover damages and costs, and where the spam was sent in contravention of the authority granted or the policies set by the electronic mail service provider, and the sender knew of them or they were posted on the provider's website, the injured person may also recover attorney fees and costs and elect, in lieu of actual damages, the lesser of $10 for each spam message transmitted or $25,000 a day.

An electronic mail service provider injured the same way may elect to recover $1 for each intended recipient who is its end user, or $25,000 for each day an attempt is made, an amount a court may adjust for the number of complaints, the defendant's culpability and history, and its economic gain.

The prohibition is framed as a rule against falsified or forged transmission and routing information, the kind of state rule against falsity or deception in a commercial electronic mail message that the federal CAN-SPAM Act's preemption clause leaves in force. The sections this entry groups came into force on different days.

No person may install or use a pen register or a trap and trace device without first obtaining a court order under section 19.2-70.2.

A pen register is a device or process that records or decodes dialing, routing, addressing or signaling information transmitted by an instrument from which a wire or electronic communication is transmitted, and a trap and trace device is one that captures the incoming impulses identifying the originating number or other dialing, routing, addressing or signaling information; neither term reaches the contents of a communication.

A pen register does not include a device or process a provider or customer of a wire or electronic communication service uses for billing, or recording incident to billing, for the provider's communications services, or one a provider or customer of a wire communication service uses for cost accounting or similar purposes in the ordinary course of its business.

A court order is not required for a provider of electronic or wire communication service to use such a device in operating, maintaining and testing its service or protecting its rights or property or its users from abuse or unlawful use of the service, to record that a communication was initiated or completed to protect itself, another provider or a user from fraudulent, unlawful or abusive use of the service, or where the consent of the user of that service has been obtained.

All three exceptions, the user-consent one included, are exceptions for a provider; the section has none for anyone else. A knowing violation is a Class 1 misdemeanor, and the section states no civil action of its own. No day on which the section came into force has been located.

It is a Class 6 felony to intentionally intercept, or procure another person to intercept, a wire, electronic or oral communication, or to intentionally disclose or use its contents knowing or having reason to know they were obtained through interception. It is not a criminal offense for a person to intercept a communication where that person is a party to it or one of the parties has given prior consent, so one party's consent is enough and a business may record its own calls.

An oral communication is protected only where the speaker exhibits an expectation that it is not subject to interception under circumstances justifying that expectation. An electronic communication does not include a communication through a tone-only paging device, a communication from a device that tracks the movement of a person or object, or electronic funds transfer information a financial institution stores.

To intercept is to acquire the contents through an electronic, mechanical or other device, a term that excludes telephone equipment furnished by a provider, or by the subscriber for connection to the service, and used in the ordinary course of the subscriber's or user's business.

It is also not an offense to intercept an electronic communication made through a system configured so that it is readily accessible to the general public, to intercept several categories of radio communication, to use a pen register or trap and trace device as sections 19.2-70.1 and 19.2-70.2 allow, or for a provider of electronic communication service to record that a communication was initiated or completed to protect itself, another provider or a user from fraudulent, unlawful or abusive use of the service.

A person or entity providing an electronic communication service to the public must not intentionally divulge the contents of a communication while in transmission on its service to anyone other than an addressee, an intended recipient, or their agent. It may divulge them as the chapter's provider-employee exception or section 19.2-67 allows.

It may also divulge them with the lawful consent of the originator or an addressee or intended recipient, to a person who forwards the communication to its destination, or, where the contents were inadvertently obtained and appear to pertain to a crime, to a law-enforcement agency. Violating the provider-divulgence duty is a Class 1 misdemeanor.

Anyone whose communication is intercepted, disclosed or used in violation of the chapter has a civil action for actual damages but not less than liquidated damages of $400 a day of violation or $4,000, whichever is higher, doubled to $800 a day or $8,000 for a communication between spouses, an attorney and client, a licensed practitioner of the healing arts and patient, a licensed professional counselor, clinical social worker, psychologist or marriage and family therapist and client, or a clergy member and a person seeking spiritual counsel, plus punitive damages and a reasonable attorney fee and litigation costs.

The provisions this entry describes came into force on different days.

A caller, a person who contacts or tries to contact a subscriber in Virginia by telephone, must not use an automatic dialing-announcing device (one that selects and dials telephone numbers and plays a prerecorded or synthesized voice message) to make a commercial telephone solicitation unless the subscriber has knowingly or voluntarily requested, consented to, permitted or authorized receipt of the message, or a live operator first discloses the sending entity's name, the message's purpose, the kinds of goods or services promoted and, if applicable, that the message seeks payment or a commitment of funds, and obtains the subscriber's consent before the solicitation is delivered.

A commercial telephone solicitation is an unsolicited call to a subscriber by a person who has had no prior business or personal relationship with the subscriber, made to solicit the purchase or the consideration of the purchase of goods or services; calls the Commonwealth or a political subdivision initiates for exclusively public purposes are excluded.

A caller using such a device, or any other device playing a prerecorded or synthesized voice message, must design and operate it to disconnect within five seconds after the called party ends the call. A violation is a prohibited practice under the Virginia Consumer Protection Act and subject to all of that Act's enforcement provisions.

Under that Act, a person who suffers loss as the result of a violation may recover actual damages or $500, whichever is greater, which the trier of fact may raise for a willful violation to not more than three times actual damages or $1,000, whichever is greater, plus reasonable attorney fees and court costs. On a willful violation, the Attorney General, an attorney for the Commonwealth or a local attorney may recover a civil penalty of not more than $2,500 for each violation. The chapter states no criminal penalty. No day on which the chapter came into force has been located.

A telephone solicitation is a telephone call to a natural person's residence in Virginia, to a landline or wireless telephone with a Virginia area code, or to a telephone registered to a Virginia resident, or a text message to a wireless telephone with a Virginia area code or registered to a Virginia resident, made to offer or advertise property, goods or services for sale, lease, license or investment, including an extension of credit, or for a fraudulent purpose.

Chapter 626 of the 2025 Acts, effective January 1, 2026, recast the Act's duties from telephone solicitation calls to telephone solicitations, and added that a recipient opts out of a text-message solicitation by replying UNSUBSCRIBE or STOP. A telephone solicitor must not initiate a telephone solicitation outside 8:00 a.m. to 9:00 p.m. local time at the contacted person's location without that person's prior consent.

On a telephone call, the solicitor must identify themselves by first and last name and name the person on whose behalf the solicitation is made promptly upon making contact.

Every solicitation must transmit the solicitor's telephone number, and its name where the carrier makes it available, and the number must let any individual ask during regular business hours not to receive solicitations; for a text message, a number that accepts a reply-text request not to receive future text messages satisfies this rule.

The solicitor must not act to prevent that transmission or cause false or misleading caller-identification information to display, though it may substitute the seller's name and customer service number. If no live sales representative is available within two seconds of the person's completed greeting on a telephone call, the solicitor must play a prerecorded message stating the name and telephone number of the person on whose behalf the solicitation was made.

A solicitor must not initiate a solicitation to a number whose occupant has said they do not want solicitations made by or for that seller, a request honored for at least ten years and made for a text message by replying UNSUBSCRIBE or STOP, or to a number on the National Do Not Call Registry.

It is an affirmative defense to a do-not-call claim that the defendant established and implemented, with due care, reasonable practices and procedures to prevent such solicitations, including using a version of the Registry obtained no more than 31 days before the call.

For the do-not-call rules only, a telephone solicitation does not include a call made with the person's prior express invitation or permission evidenced by a signed written agreement naming the party and the number, a call for a seller with an established business relationship with the person (a purchase or transaction in the preceding 18 months, or an inquiry or application in the preceding three months), or a call by a solicitor with a personal relationship to the person; the business-relationship and personal-relationship exemptions end once the person has said they do not want solicitations.

Those exemptions do not reach the calling-hour, identification, caller-identification or abandoned-call rules. A seller on whose behalf a solicitation is made and the solicitor who makes it are jointly and severally liable for a violation of the calling-hour, identification, caller-identification or do-not-call rules.

A solicitation is presumed made on the seller's behalf unless the seller shows by clear and convincing evidence that it neither retained nor requested the solicitor's calls and that they were made without its knowledge or consent.

An aggrieved natural person may sue a responsible person to enjoin a violation and recover $500 for a first violation, $1,000 for a second and $5,000 for each later violation, which a court may raise to as much as $5,000 for a willful first or second violation, plus reasonable attorney fees and court costs.

The Attorney General, an attorney for the Commonwealth or a locality's attorney may sue for the same damages for aggrieved persons, and on a willful violation a court may also assess a civil penalty of not more than $5,000 for each violation, paid into the Literary Fund or the locality's general fund. The sections this entry groups came into force on different days.

Commercial entities that knowingly publish or distribute material harmful to minors on websites containing a substantial portion of such material, as the Act defines that term, must verify that visitors are 18 or older using a commercially available age verification database or another commercially reasonable method.