HB1368 • 2026

Consumer Data Protection Act; individual action for damages or penalty, social media platforms.

<p class=ldtitle>A BILL to amend and reenact § 59.1-584 of the Code of Virginia and to amend the Code of Virginia by adding a section numbered 59.1-584.1, relating to Consumer Data Protection Act; individual action for damages or penalty; social media platforms.</p>

Children

Enacted

This bill passed the Legislature and reached final enactment based on the latest official action.

Sponsor: Thomas
Last action: 2026-02-18
Official status: Failed
Effective date: Not listed

Plain English Breakdown

The official text specifies that parents and minors must give notice within 7 days, not 30 as initially stated.

Consumer Data Protection Act for Social Media Platforms

This law allows parents and minors who suffer losses due to violations of the Consumer Data Protection Act by social media platforms to sue the companies after giving them a chance to fix the problem.

What This Bill Does

Allows parents or minors harmed by social media platform violations to take legal action against the company.
Requires parents or minors to give the company 7 days' notice and an opportunity to correct the issue before filing a lawsuit, not 30 days as initially stated.
Enables parents or minors to seek damages, penalties, and other relief if the company does not fix the violation within 7 days.

Who It Names or Affects

Parents of children using social media platforms
Minors who use social media platforms and suffer losses due to data protection issues
Social media companies that violate the Consumer Data Protection Act

Terms To Know

Controller or Processor: A company that collects, stores, or processes personal information.
Civil Penalty: Money a company has to pay as punishment for breaking the law.

Limits and Unknowns

The bill does not specify what happens if the social media platform fixes the issue within 7 days.
It is unclear how this new section interacts with existing laws and regulations regarding data protection.
The exact amount of damages a parent or minor can receive depends on the specific violation.

Bill History

2026-02-18 House
Left in Committee Communications, Technology and Innovation
2026-02-04 Technology and Innovation
Subcommittee recommends striking from the docket (10-Y 0-N)
2026-01-29 Technology and Innovation
Assigned HST sub: Technology and Innovation
2026-01-20 House
Presented and ordered printed 26104952D
2026-01-20 Communications, Technology and Innovation
Referred to Committee on Communications, Technology and Innovation

Official Summary Text

Consumer Data Protection Act; individual action for damages or penalty; social media platforms.
Allows a parent or minor who suffers loss as the result of a violation of Consumer Data Protection Act provisions relating to social media platforms to initiate an action against a controller or processor in violation of such provisions. The bill requires a parent or minor to provide a controller or processor 30 days' written notice and an opportunity for the controller or processor to cure the noticed violation prior to initiating such an action.

Current Bill Text

Read the full stored bill text

A BILL to amend and reenact §
59.1-584
of the Code of Virginia and to amend the Code of Virginia by adding a section numbered
59.1-584.1
, relating to Consumer Data Protection Act; individual action for damages or penalty; social media platforms.

Be it enacted by the General Assembly of Virginia:

1. That §
59.1-584
of the Code of Virginia is amended and reenacted and that the Code of Virginia is amended by adding a section numbered
59.1-584.1
as follows:

§
59.1-584
. Enforcement; civil penalty; expenses.

A. The Attorney General shall have exclusive authority to enforce the provisions of this chapter
, except as provided for in §
59.1-584.1
.

B. Prior to initiating any action under this
chapter
section
, the Attorney General shall provide a controller or processor 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated. If within the 30-day period the controller or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the controller or processor.

C. If a controller or processor continues to violate this chapter following the cure period in subsection B or breaches an express written statement provided to the Attorney General under
that
such
subsection, the Attorney General may initiate an action in the name of the Commonwealth and may seek an injunction to restrain any violations of this chapter and civil penalties of up to $7,500 for each violation under this chapter. All civil penalties, expenses, and attorney fees collected pursuant to this
chapter
section
shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.

D. The Attorney General may recover reasonable expenses incurred in investigating and preparing the case, including attorney fees, in any action initiated under this
chapter
section
.

E. Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of this chapter or under any other law.

§
59.1-584.1
. Individual action for damages or penalty
; social media platforms
.

A.
Prior to initiating any action under this section,
a parent or minor
shall provide a controller or processor 30 days' written notice identifying the specific provisions of
§
59.1-577.1
such parent or minor
alleges have been or are being violated. If
,
within the 30-day period
,
the controller or processor cures the noticed violation and provides
such parent or minor
an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the controller or processor
.
A parent or minor shall offer a controller or processor an opportunity to cure
pursuant to this subsection
only once per substantially similar violation prior to initiating an action under this section.

B.
If a controller or processor continues to violate §
59.1-577.1
following the cure period in subsection A or breaches an express written statement provided to the
parent or minor
under such subsection, a
ny parent or minor who suffers loss as the result of a violation of §
59.1-577.1
shall be entitled to initiate an action
against
the
controller or processor
to recover actual
damages, or $500 per violation, whichever is greater.
If the trier of fact finds that the violation was willful, it may increase damages to an amount not exceeding three times the actual damages sustained, or $1,000, whichever is greater.

C.
Notwithstanding any other provision of law to the contrary, in addition to any damages awarded, such
parent or minor
may
also
be awarded
injunctive or declaratory relief and
reasonable attorney fees
and
court costs.

D.
The remedies provided by this section

are cumulative and
shall supplement any other remedies available at law or equity
under this chapter
.
Nothing in this section
shall limit
, modify, impair,
or supersede the authority
granted to
the Attorney General
pursuant to
§
59.1-584
.