Virginia 2025 Regular Session

Virginia House Bill HB2250 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	2025 SESSION
2	2
3	3	INTRODUCED
4	4
5	5	25104553D
6	6
7	7	HOUSE BILL NO. 2250
8	8
9	9	Offered January 8, 2025
10	10
11	11	Prefiled January 7, 2025
12	12
13	13	A BILL to amend and reenact 59.1-200, as it is currently effective and as it shall become effective, 59.1-575, 59.1-577, 59.1-578, and 59.1-584 of the Code of Virginia and to amend the Code of Virginia by adding in Title 59.1 a chapter numbered 58, consisting of sections numbered 59.1-607 through 59.1-611, relating to Consumer Data Protection Act; Artificial Intelligence Training Data Transparency Act.
14	14
15	15
16	16
17	17	PatronMaldonado
18	18
19	19
20	20
21	21	Committee Referral Pending
22	22
23	23
24	24
25	25	Be it enacted by the General Assembly of Virginia:
26	26
27	27	1. That 59.1-200, as it is currently effective and as it shall become effective, 59.1-575, 59.1-577, 59.1-578, and 59.1-584 of the Code of Virginia are amended and reenacted and that the Code of Virginia is amended by adding in Title 59.1 a chapter numbered 58, consisting of sections numbered 59.1-607 through 59.1-611, as follows:
28	28
29	29	59.1-200. (Effective until July 1, 2025) Prohibited practices.
30	30
31	31	A. The following fraudulent acts or practices committed by a supplier in connection with a consumer transaction are hereby declared unlawful:
32	32
33	33	1. Misrepresenting goods or services as those of another;
34	34
35	35	2. Misrepresenting the source, sponsorship, approval, or certification of goods or services;
36	36
37	37	3. Misrepresenting the affiliation, connection, or association of the supplier, or of the goods or services, with another;
38	38
39	39	4. Misrepresenting geographic origin in connection with goods or services;
40	40
41	41	5. Misrepresenting that goods or services have certain quantities, characteristics, ingredients, uses, or benefits;
42	42
43	43	6. Misrepresenting that goods or services are of a particular standard, quality, grade, style, or model;
44	44
45	45	7. Advertising or offering for sale goods that are used, secondhand, repossessed, defective, blemished, deteriorated, or reconditioned, or that are "seconds," irregulars, imperfects, or "not first class," without clearly and unequivocally indicating in the advertisement or offer for sale that the goods are used, secondhand, repossessed, defective, blemished, deteriorated, reconditioned, or are "seconds," irregulars, imperfects, or "not first class";
46	46
47	47	8. Advertising goods or services with intent not to sell them as advertised, or with intent not to sell at the price or upon the terms advertised.
48	48
49	49	In any action brought under this subdivision, the refusal by any person, or any employee, agent, or servant thereof, to sell any goods or services advertised or offered for sale at the price or upon the terms advertised or offered, shall be prima facie evidence of a violation of this subdivision. This paragraph shall not apply when it is clearly and conspicuously stated in the advertisement or offer by which such goods or services are advertised or offered for sale, that the supplier or offeror has a limited quantity or amount of such goods or services for sale, and the supplier or offeror at the time of such advertisement or offer did in fact have or reasonably expected to have at least such quantity or amount for sale;
50	50
51	51	9. Making false or misleading statements of fact concerning the reasons for, existence of, or amounts of price reductions;
52	52
53	53	10. Misrepresenting that repairs, alterations, modifications, or services have been performed or parts installed;
54	54
55	55	11. Misrepresenting by the use of any written or documentary material that appears to be an invoice or bill for merchandise or services previously ordered;
56	56
57	57	12. Notwithstanding any other provision of law, using in any manner the words "wholesale," "wholesaler," "factory," or "manufacturer" in the supplier's name, or to describe the nature of the supplier's business, unless the supplier is actually engaged primarily in selling at wholesale or in manufacturing the goods or services advertised or offered for sale;
58	58
59	59	13. Using in any contract or lease any liquidated damage clause, penalty clause, or waiver of defense, or attempting to collect any liquidated damages or penalties under any clause, waiver, damages, or penalties that are void or unenforceable under any otherwise applicable laws of the Commonwealth, or under federal statutes or regulations;
60	60
61	61	13a. Failing to provide to a consumer, or failing to use or include in any written document or material provided to or executed by a consumer, in connection with a consumer transaction any statement, disclosure, notice, or other information however characterized when the supplier is required by 16 C.F.R. Part 433 to so provide, use, or include the statement, disclosure, notice, or other information in connection with the consumer transaction;
62	62
63	63	14. Using any other deception, fraud, false pretense, false promise, or misrepresentation in connection with a consumer transaction;
64	64
65	65	15. Violating any provision of 3.2-6509, 3.2-6512, 3.2-6513, 3.2-6513.1, 3.2-6514, 3.2-6515, 3.2-6516, or 3.2-6519 is a violation of this chapter;
66	66
67	67	16. Failing to disclose all conditions, charges, or fees relating to:
68	68
69	69	a. The return of goods for refund, exchange, or credit. Such disclosure shall be by means of a sign attached to the goods, or placed in a conspicuous public area of the premises of the supplier, so as to be readily noticeable and readable by the person obtaining the goods from the supplier. If the supplier does not permit a refund, exchange, or credit for return, he shall so state on a similar sign. The provisions of this subdivision shall not apply to any retail merchant who has a policy of providing, for a period of not less than 20 days after date of purchase, a cash refund or credit to the purchaser's credit card account for the return of defective, unused, or undamaged merchandise upon presentation of proof of purchase. In the case of merchandise paid for by check, the purchase shall be treated as a cash purchase and any refund may be delayed for a period of 10 banking days to allow for the check to clear. This subdivision does not apply to sale merchandise that is obviously distressed, out of date, post season, or otherwise reduced for clearance; nor does this subdivision apply to special order purchases where the purchaser has requested the supplier to order merchandise of a specific or unusual size, color, or brand not ordinarily carried in the store or the store's catalog; nor shall this subdivision apply in connection with a transaction for the sale or lease of motor vehicles, farm tractors, or motorcycles as defined in 46.2-100;
70	70
71	71	b. A layaway agreement. Such disclosure shall be furnished to the consumer (i) in writing at the time of the layaway agreement, or (ii) by means of a sign placed in a conspicuous public area of the premises of the supplier, so as to be readily noticeable and readable by the consumer, or (iii) on the bill of sale. Disclosure shall include the conditions, charges, or fees in the event that a consumer breaches the agreement;
72	72
73	73	16a. Failing to provide written notice to a consumer of an existing open-end credit balance in excess of $5 (i) on an account maintained by the supplier and (ii) resulting from such consumer's overpayment on such account. Suppliers shall give consumers written notice of such credit balances within 60 days of receiving overpayments. If the credit balance information is incorporated into statements of account furnished consumers by suppliers within such 60-day period, no separate or additional notice is required;
74	74
75	75	17. If a supplier enters into a written agreement with a consumer to resolve a dispute that arises in connection with a consumer transaction, failing to adhere to the terms and conditions of such an agreement;
76	76
77	77	18. Violating any provision of the Virginia Health Club Act, Chapter 24 ( 59.1-294 et seq.);
78	78
79	79	19. Violating any provision of the Virginia Home Solicitation Sales Act, Chapter 2.1 ( 59.1-21.1 et seq.);
80	80
81	81	20. Violating any provision of the Automobile Repair Facilities Act, Chapter 17.1 ( 59.1-207.1 et seq.);
82	82
83	83	21. Violating any provision of the Virginia Lease-Purchase Agreement Act, Chapter 17.4 ( 59.1-207.17 et seq.);
84	84
85	85	22. Violating any provision of the Prizes and Gifts Act, Chapter 31 ( 59.1-415 et seq.);
86	86
87	87	23. Violating any provision of the Virginia Public Telephone Information Act, Chapter 32 ( 59.1-424 et seq.);
88	88
89	89	24. Violating any provision of 54.1-1505;
90	90
91	91	25. Violating any provision of the Motor Vehicle Manufacturers' Warranty Adjustment Act, Chapter 17.6 ( 59.1-207.34 et seq.);
92	92
93	93	26. Violating any provision of 3.2-5627, relating to the pricing of merchandise;
94	94
95	95	27. Violating any provision of the Pay-Per-Call Services Act, Chapter 33 ( 59.1-429 et seq.);
96	96
97	97	28. Violating any provision of the Extended Service Contract Act, Chapter 34 ( 59.1-435 et seq.);
98	98
99	99	29. Violating any provision of the Virginia Membership Camping Act, Chapter 25 ( 59.1-311 et seq.);
100	100
101	101	30. Violating any provision of the Comparison Price Advertising Act, Chapter 17.7 ( 59.1-207.40 et seq.);
102	102
103	103	31. Violating any provision of the Virginia Travel Club Act, Chapter 36 ( 59.1-445 et seq.);
104	104
105	105	32. Violating any provision of 46.2-1231 and 46.2-1233.1;
106	106
107	107	33. Violating any provision of Chapter 40 ( 54.1-4000 et seq.) of Title 54.1;
108	108
109	109	34. Violating any provision of Chapter 10.1 ( 58.1-1031 et seq.) of Title 58.1;
110	110
111	111	35. Using the consumer's social security number as the consumer's account number with the supplier, if the consumer has requested in writing that the supplier use an alternate number not associated with the consumer's social security number;
112	112
113	113	36. Violating any provision of Chapter 18 ( 6.2-1800 et seq.) of Title 6.2;
114	114
115	115	37. Violating any provision of 8.01-40.2;
116	116
117	117	38. Violating any provision of Article 7 ( 32.1-212 et seq.) of Chapter 6 of Title 32.1;
118	118
119	119	39. Violating any provision of Chapter 34.1 ( 59.1-441.1 et seq.);
120	120
121	121	40. Violating any provision of Chapter 20 ( 6.2-2000 et seq.) of Title 6.2;
122	122
123	123	41. Violating any provision of the Virginia Post-Disaster Anti-Price Gouging Act, Chapter 46 ( 59.1-525 et seq.). For the purposes of this subdivision, "consumer transaction" has the same meaning as provided in 59.1-526;
124	124
125	125	42. Violating any provision of Chapter 47 ( 59.1-530 et seq.);
126	126
127	127	43. Violating any provision of 59.1-443.2;
128	128
129	129	44. Violating any provision of Chapter 48 ( 59.1-533 et seq.);
130	130
131	131	45. Violating any provision of Chapter 25 ( 6.2-2500 et seq.) of Title 6.2;
132	132
133	133	46. Violating the provisions of clause (i) of subsection B of 54.1-1115;
134	134
135	135	47. Violating any provision of 18.2-239;
136	136
137	137	48. Violating any provision of Chapter 26 ( 59.1-336 et seq.);
138	138
139	139	49. Selling, offering for sale, or manufacturing for sale a children's product the supplier knows or has reason to know was recalled by the U.S. Consumer Product Safety Commission. There is a rebuttable presumption that a supplier has reason to know a children's product was recalled if notice of the recall has been posted continuously at least 30 days before the sale, offer for sale, or manufacturing for sale on the website of the U.S. Consumer Product Safety Commission. This prohibition does not apply to children's products that are used, secondhand or "seconds";
140	140
141	141	50. Violating any provision of Chapter 44.1 ( 59.1-518.1 et seq.);
142	142
143	143	51. Violating any provision of Chapter 22 ( 6.2-2200 et seq.) of Title 6.2;
144	144
145	145	52. Violating any provision of 8.2-317.1;
146	146
147	147	53. Violating subsection A of 9.1-149.1;
148	148
149	149	54. Selling, offering for sale, or using in the construction, remodeling, or repair of any residential dwelling in the Commonwealth, any drywall that the supplier knows or has reason to know is defective drywall. This subdivision shall not apply to the sale or offering for sale of any building or structure in which defective drywall has been permanently installed or affixed;
150	150
151	151	55. Engaging in fraudulent or improper or dishonest conduct as defined in 54.1-1118 while engaged in a transaction that was initiated (i) during a declared state of emergency as defined in 44-146.16 or (ii) to repair damage resulting from the event that prompted the declaration of a state of emergency, regardless of whether the supplier is licensed as a contractor in the Commonwealth pursuant to Chapter 11 ( 54.1-1100 et seq.) of Title 54.1;
152	152
153	153	56. Violating any provision of Chapter 33.1 ( 59.1-434.1 et seq.);
154	154
155	155	57. Violating any provision of 18.2-178, 18.2-178.1, or 18.2-200.1;
156	156
157	157	58. Violating any provision of Chapter 17.8 ( 59.1-207.45 et seq.). For the purposes of this subdivision, "consumer transaction" also includes transactions involving an automatic renewal or continuous service offer by a supplier to a small business, as those terms are defined in 59.1-207.45;
158	158
159	159	59. Violating any provision of subsection E of 32.1-126;
160	160
161	161	60. Violating any provision of 54.1-111 relating to the unlicensed practice of a profession licensed under Chapter 11 ( 54.1-1100 et seq.) or Chapter 21 ( 54.1-2100 et seq.) of Title 54.1;
162	162
163	163	61. Violating any provision of 2.2-2001.5;
164	164
165	165	62. Violating any provision of Chapter 5.2 ( 54.1-526 et seq.) of Title 54.1;
166	166
167	167	63. Violating any provision of 6.2-312;
168	168
169	169	64. Violating any provision of Chapter 20.1 ( 6.2-2026 et seq.) of Title 6.2;
170	170
171	171	65. Violating any provision of Chapter 26 ( 6.2-2600 et seq.) of Title 6.2;
172	172
173	173	66. Violating any provision of Chapter 54 ( 59.1-586 et seq.);
174	174
175	175	67. Knowingly violating any provision of 8.01-27.5;
176	176
177	177	68. Failing to, in accordance with 59.1-207.46, (i) make available a conspicuous online option to cancel a recurring purchase of a good or service or (ii) with respect to a free trial lasting more than 30 days, notify a consumer of his option to cancel such free trial within 30 days of the end of the trial period to avoid an obligation to pay for the goods or services;
178	178
179	179	69. Selling or offering for sale any substance intended for human consumption, orally or by inhalation, that contains a synthetic derivative of tetrahydrocannabinol. As used in this subdivision, "synthetic derivative" means a chemical compound produced by man through a chemical transformation to turn a compound into a different compound by adding or subtracting molecules to or from the original compound. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.) or (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1;
180	180
181	181	70. Selling or offering for sale to a person younger than 21 years of age any substance intended for human consumption, orally or by inhalation, that contains tetrahydrocannabinol. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.) or (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1;
182	182
183	183	71. Selling or offering for sale any substance intended for human consumption, orally or by inhalation, that contains tetrahydrocannabinol, unless such substance is (i) contained in child-resistant packaging, as defined in 4.1-600; (ii) equipped with a label that states, in English and in a font no less than 1/16 of an inch, (a) that the substance contains tetrahydrocannabinol and may not be sold to persons younger than 21 years of age, (b) all ingredients contained in the substance, (c) the amount of such substance that constitutes a single serving, and (d) the total percentage and milligrams of tetrahydrocannabinol included in the substance and the number of milligrams of tetrahydrocannabinol that are contained in each serving; and (iii) accompanied by a certificate of analysis, produced by an independent laboratory that is accredited pursuant to standard ISO/IEC 17025 of the International Organization of Standardization by a third-party accrediting body, that states the tetrahydrocannabinol concentration of the substance or the tetrahydrocannabinol concentration of the batch from which the substance originates. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.) or (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1;
184	184
185	185	72. Manufacturing, offering for sale at retail, or selling at retail an industrial hemp extract, as defined in 3.2-5145.1, a food containing an industrial hemp extract, or a substance containing tetrahydrocannabinol that depicts or is in the shape of a human, animal, vehicle, or fruit;
186	186
187	187	73. Selling or offering for sale any substance intended for human consumption, orally or by inhalation, that contains tetrahydrocannabinol and, without authorization, bears, is packaged in a container or wrapper that bears, or is otherwise labeled to bear the trademark, trade name, famous mark as defined in 15 U.S.C. 1125, or other identifying mark, imprint, or device, or any likeness thereof, of a manufacturer, processor, packer, or distributor of a product intended for human consumption other than the manufacturer, processor, packer, or distributor that did in fact so manufacture, process, pack, or distribute such substance;
188	188
189	189	74. Selling or offering for sale a topical hemp product, as defined in 3.2-4112, that does not include a label stating that the product is not intended for human consumption. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.), (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1, or (iii) apply to topical hemp products that were manufactured prior to July 1, 2023, provided that the person provides documentation of the date of manufacture if requested;
190	190
191	191	75. Violating any provision of 59.1-466.8;
192	192
193	193	76. Violating subsection F of 36-96.3:1;
194	194
195	195	77. Selling or offering for sale (i) any kratom product to a person younger than 21 years of age or (ii) any kratom product that does not include a label listing all ingredients and with the following guidance: "This product may be harmful to your health, has not been evaluated by the FDA, and is not intended to diagnose, treat, cure, or prevent any disease." As used in this subdivision, "kratom" means any part of the leaf of the plant Mitragyna speciosa or any extract thereof;
196	196
197	197	78. Advertising of any ignition interlock system in Virginia by an ignition interlock vendor not approved by the Commission on the Virginia Alcohol Safety Action Program to operate in Virginia; targeted advertising of any ignition interlock system to a person before determination of guilt; and any advertising, whether before or after determination of guilt, without a conspicuous statement that such advertisement is not affiliated with any government agency. For purposes of this subdivision, "ignition interlock system" has the same meaning as ascribed to that term in 18.2-270.1 and "targeted advertising" has the same meaning ascribed to that term in 59.1-575 and includes direct mailings to an individual. This provision shall not apply to ignition interlock service vendor ads, pamphlets, or kiosk advertisements approved by the Commission on the Virginia Alcohol Safety Action Program and provided at a Commission-approved location;
198	198
199	199	79. Failing to disclose the total cost of a good or continuous service, as defined in 59.1-207.45, to a consumer, including any mandatory fees or charges, prior to entering into an agreement for the sale of any such good or provision of any such continuous service;
200	200
201	201	80. Violating any provision of the Unfair Real Estate Service Agreement Act ( 55.1-3200 et seq.);
202	202
203	203	81. Selling or offering for sale services as a professional mold remediator to be performed upon any residential dwelling without holding a mold remediation certification from the Institute of Inspection, Cleaning and Restoration Certification (IICRC); and
204	204
205	205	82. Willfully violating any provision of 59.1-444.4; and
206	206
207	207	83. Violating any provision of the Artificial Intelligence Training Data Transparency Act ( 59.1-607 et seq.).
208	208
209	209	B. Nothing in this section shall be construed to invalidate or make unenforceable any contract or lease solely by reason of the failure of such contract or lease to comply with any other law of the Commonwealth or any federal statute or regulation, to the extent such other law, statute, or regulation provides that a violation of such law, statute, or regulation shall not invalidate or make unenforceable such contract or lease.
210	210
211	211	59.1-200. (Effective July 1, 2025) Prohibited practices.
212	212
213	213	A. The following fraudulent acts or practices committed by a supplier in connection with a consumer transaction are hereby declared unlawful:
214	214
215	215	1. Misrepresenting goods or services as those of another;
216	216
217	217	2. Misrepresenting the source, sponsorship, approval, or certification of goods or services;
218	218
219	219	3. Misrepresenting the affiliation, connection, or association of the supplier, or of the goods or services, with another;
220	220
221	221	4. Misrepresenting geographic origin in connection with goods or services;
222	222
223	223	5. Misrepresenting that goods or services have certain quantities, characteristics, ingredients, uses, or benefits;
224	224
225	225	6. Misrepresenting that goods or services are of a particular standard, quality, grade, style, or model;
226	226
227	227	7. Advertising or offering for sale goods that are used, secondhand, repossessed, defective, blemished, deteriorated, or reconditioned, or that are "seconds," irregulars, imperfects, or "not first class," without clearly and unequivocally indicating in the advertisement or offer for sale that the goods are used, secondhand, repossessed, defective, blemished, deteriorated, reconditioned, or are "seconds," irregulars, imperfects, or "not first class";
228	228
229	229	8. Advertising goods or services with intent not to sell them as advertised, or with intent not to sell at the price or upon the terms advertised.
230	230
231	231	In any action brought under this subdivision, the refusal by any person, or any employee, agent, or servant thereof, to sell any goods or services advertised or offered for sale at the price or upon the terms advertised or offered, shall be prima facie evidence of a violation of this subdivision. This paragraph shall not apply when it is clearly and conspicuously stated in the advertisement or offer by which such goods or services are advertised or offered for sale, that the supplier or offeror has a limited quantity or amount of such goods or services for sale, and the supplier or offeror at the time of such advertisement or offer did in fact have or reasonably expected to have at least such quantity or amount for sale;
232	232
233	233	9. Making false or misleading statements of fact concerning the reasons for, existence of, or amounts of price reductions;
234	234
235	235	10. Misrepresenting that repairs, alterations, modifications, or services have been performed or parts installed;
236	236
237	237	11. Misrepresenting by the use of any written or documentary material that appears to be an invoice or bill for merchandise or services previously ordered;
238	238
239	239	12. Notwithstanding any other provision of law, using in any manner the words "wholesale," "wholesaler," "factory," or "manufacturer" in the supplier's name, or to describe the nature of the supplier's business, unless the supplier is actually engaged primarily in selling at wholesale or in manufacturing the goods or services advertised or offered for sale;
240	240
241	241	13. Using in any contract or lease any liquidated damage clause, penalty clause, or waiver of defense, or attempting to collect any liquidated damages or penalties under any clause, waiver, damages, or penalties that are void or unenforceable under any otherwise applicable laws of the Commonwealth, or under federal statutes or regulations;
242	242
243	243	13a. Failing to provide to a consumer, or failing to use or include in any written document or material provided to or executed by a consumer, in connection with a consumer transaction any statement, disclosure, notice, or other information however characterized when the supplier is required by 16 C.F.R. Part 433 to so provide, use, or include the statement, disclosure, notice, or other information in connection with the consumer transaction;
244	244
245	245	14. Using any other deception, fraud, false pretense, false promise, or misrepresentation in connection with a consumer transaction;
246	246
247	247	15. Violating any provision of 3.2-6509, 3.2-6512, 3.2-6513, 3.2-6513.1, 3.2-6514, 3.2-6515, 3.2-6516, or 3.2-6519 is a violation of this chapter;
248	248
249	249	16. Failing to disclose all conditions, charges, or fees relating to:
250	250
251	251	a. The return of goods for refund, exchange, or credit. Such disclosure shall be by means of a sign attached to the goods, or placed in a conspicuous public area of the premises of the supplier, so as to be readily noticeable and readable by the person obtaining the goods from the supplier. If the supplier does not permit a refund, exchange, or credit for return, he shall so state on a similar sign. The provisions of this subdivision shall not apply to any retail merchant who has a policy of providing, for a period of not less than 20 days after date of purchase, a cash refund or credit to the purchaser's credit card account for the return of defective, unused, or undamaged merchandise upon presentation of proof of purchase. In the case of merchandise paid for by check, the purchase shall be treated as a cash purchase and any refund may be delayed for a period of 10 banking days to allow for the check to clear. This subdivision does not apply to sale merchandise that is obviously distressed, out of date, post season, or otherwise reduced for clearance; nor does this subdivision apply to special order purchases where the purchaser has requested the supplier to order merchandise of a specific or unusual size, color, or brand not ordinarily carried in the store or the store's catalog; nor shall this subdivision apply in connection with a transaction for the sale or lease of motor vehicles, farm tractors, or motorcycles as defined in 46.2-100;
252	252
253	253	b. A layaway agreement. Such disclosure shall be furnished to the consumer (i) in writing at the time of the layaway agreement, or (ii) by means of a sign placed in a conspicuous public area of the premises of the supplier, so as to be readily noticeable and readable by the consumer, or (iii) on the bill of sale. Disclosure shall include the conditions, charges, or fees in the event that a consumer breaches the agreement;
254	254
255	255	16a. Failing to provide written notice to a consumer of an existing open-end credit balance in excess of $5 (i) on an account maintained by the supplier and (ii) resulting from such consumer's overpayment on such account. Suppliers shall give consumers written notice of such credit balances within 60 days of receiving overpayments. If the credit balance information is incorporated into statements of account furnished consumers by suppliers within such 60-day period, no separate or additional notice is required;
256	256
257	257	17. If a supplier enters into a written agreement with a consumer to resolve a dispute that arises in connection with a consumer transaction, failing to adhere to the terms and conditions of such an agreement;
258	258
259	259	18. Violating any provision of the Virginia Health Club Act, Chapter 24 ( 59.1-294 et seq.);
260	260
261	261	19. Violating any provision of the Virginia Home Solicitation Sales Act, Chapter 2.1 ( 59.1-21.1 et seq.);
262	262
263	263	20. Violating any provision of the Automobile Repair Facilities Act, Chapter 17.1 ( 59.1-207.1 et seq.);
264	264
265	265	21. Violating any provision of the Virginia Lease-Purchase Agreement Act, Chapter 17.4 ( 59.1-207.17 et seq.);
266	266
267	267	22. Violating any provision of the Prizes and Gifts Act, Chapter 31 ( 59.1-415 et seq.);
268	268
269	269	23. Violating any provision of the Virginia Public Telephone Information Act, Chapter 32 ( 59.1-424 et seq.);
270	270
271	271	24. Violating any provision of 54.1-1505;
272	272
273	273	25. Violating any provision of the Motor Vehicle Manufacturers' Warranty Adjustment Act, Chapter 17.6 ( 59.1-207.34 et seq.);
274	274
275	275	26. Violating any provision of 3.2-5627, relating to the pricing of merchandise;
276	276
277	277	27. Violating any provision of the Pay-Per-Call Services Act, Chapter 33 ( 59.1-429 et seq.);
278	278
279	279	28. Violating any provision of the Extended Service Contract Act, Chapter 34 ( 59.1-435 et seq.);
280	280
281	281	29. Violating any provision of the Virginia Membership Camping Act, Chapter 25 ( 59.1-311 et seq.);
282	282
283	283	30. Violating any provision of the Comparison Price Advertising Act, Chapter 17.7 ( 59.1-207.40 et seq.);
284	284
285	285	31. Violating any provision of the Virginia Travel Club Act, Chapter 36 ( 59.1-445 et seq.);
286	286
287	287	32. Violating any provision of 46.2-1231 and 46.2-1233.1;
288	288
289	289	33. Violating any provision of Chapter 40 ( 54.1-4000 et seq.) of Title 54.1;
290	290
291	291	34. Violating any provision of Chapter 10.1 ( 58.1-1031 et seq.) of Title 58.1;
292	292
293	293	35. Using the consumer's social security number as the consumer's account number with the supplier, if the consumer has requested in writing that the supplier use an alternate number not associated with the consumer's social security number;
294	294
295	295	36. Violating any provision of Chapter 18 ( 6.2-1800 et seq.) of Title 6.2;
296	296
297	297	37. Violating any provision of 8.01-40.2;
298	298
299	299	38. Violating any provision of Article 7 ( 32.1-212 et seq.) of Chapter 6 of Title 32.1;
300	300
301	301	39. Violating any provision of Chapter 34.1 ( 59.1-441.1 et seq.);
302	302
303	303	40. Violating any provision of Chapter 20 ( 6.2-2000 et seq.) of Title 6.2;
304	304
305	305	41. Violating any provision of the Virginia Post-Disaster Anti-Price Gouging Act, Chapter 46 ( 59.1-525 et seq.). For the purposes of this subdivision, "consumer transaction" has the same meaning as provided in 59.1-526;
306	306
307	307	42. Violating any provision of Chapter 47 ( 59.1-530 et seq.);
308	308
309	309	43. Violating any provision of 59.1-443.2;
310	310
311	311	44. Violating any provision of Chapter 48 ( 59.1-533 et seq.);
312	312
313	313	45. Violating any provision of Chapter 25 ( 6.2-2500 et seq.) of Title 6.2;
314	314
315	315	46. Violating the provisions of clause (i) of subsection B of 54.1-1115;
316	316
317	317	47. Violating any provision of 18.2-239;
318	318
319	319	48. Violating any provision of Chapter 26 ( 59.1-336 et seq.);
320	320
321	321	49. Selling, offering for sale, or manufacturing for sale a children's product the supplier knows or has reason to know was recalled by the U.S. Consumer Product Safety Commission. There is a rebuttable presumption that a supplier has reason to know a children's product was recalled if notice of the recall has been posted continuously at least 30 days before the sale, offer for sale, or manufacturing for sale on the website of the U.S. Consumer Product Safety Commission. This prohibition does not apply to children's products that are used, secondhand or "seconds";
322	322
323	323	50. Violating any provision of Chapter 44.1 ( 59.1-518.1 et seq.);
324	324
325	325	51. Violating any provision of Chapter 22 ( 6.2-2200 et seq.) of Title 6.2;
326	326
327	327	52. Violating any provision of 8.2-317.1;
328	328
329	329	53. Violating subsection A of 9.1-149.1;
330	330
331	331	54. Selling, offering for sale, or using in the construction, remodeling, or repair of any residential dwelling in the Commonwealth, any drywall that the supplier knows or has reason to know is defective drywall. This subdivision shall not apply to the sale or offering for sale of any building or structure in which defective drywall has been permanently installed or affixed;
332	332
333	333	55. Engaging in fraudulent or improper or dishonest conduct as defined in 54.1-1118 while engaged in a transaction that was initiated (i) during a declared state of emergency as defined in 44-146.16 or (ii) to repair damage resulting from the event that prompted the declaration of a state of emergency, regardless of whether the supplier is licensed as a contractor in the Commonwealth pursuant to Chapter 11 ( 54.1-1100 et seq.) of Title 54.1;
334	334
335	335	56. Violating any provision of Chapter 33.1 ( 59.1-434.1 et seq.);
336	336
337	337	57. Violating any provision of 18.2-178, 18.2-178.1, or 18.2-200.1;
338	338
339	339	58. Violating any provision of Chapter 17.8 ( 59.1-207.45 et seq.). For the purposes of this subdivision, "consumer transaction" also includes transactions involving an automatic renewal or continuous service offer by a supplier to a small business, as those terms are defined in 59.1-207.45;
340	340
341	341	59. Violating any provision of subsection E of 32.1-126;
342	342
343	343	60. Violating any provision of 54.1-111 relating to the unlicensed practice of a profession licensed under Chapter 11 ( 54.1-1100 et seq.) or Chapter 21 ( 54.1-2100 et seq.) of Title 54.1;
344	344
345	345	61. Violating any provision of 2.2-2001.5;
346	346
347	347	62. Violating any provision of Chapter 5.2 ( 54.1-526 et seq.) of Title 54.1;
348	348
349	349	63. Violating any provision of 6.2-312;
350	350
351	351	64. Violating any provision of Chapter 20.1 ( 6.2-2026 et seq.) of Title 6.2;
352	352
353	353	65. Violating any provision of Chapter 26 ( 6.2-2600 et seq.) of Title 6.2;
354	354
355	355	66. Violating any provision of Chapter 54 ( 59.1-586 et seq.);
356	356
357	357	67. Knowingly violating any provision of 8.01-27.5;
358	358
359	359	68. Failing to, in accordance with 59.1-207.46, (i) make available a conspicuous online option to cancel a recurring purchase of a good or service or (ii) with respect to a free trial lasting more than 30 days, notify a consumer of his option to cancel such free trial within 30 days of the end of the trial period to avoid an obligation to pay for the goods or services;
360	360
361	361	69. Selling or offering for sale any substance intended for human consumption, orally or by inhalation, that contains a synthetic derivative of tetrahydrocannabinol. As used in this subdivision, "synthetic derivative" means a chemical compound produced by man through a chemical transformation to turn a compound into a different compound by adding or subtracting molecules to or from the original compound. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.) or (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1;
362	362
363	363	70. Selling or offering for sale to a person younger than 21 years of age any substance intended for human consumption, orally or by inhalation, that contains tetrahydrocannabinol. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.) or (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1;
364	364
365	365	71. Selling or offering for sale any substance intended for human consumption, orally or by inhalation, that contains tetrahydrocannabinol, unless such substance is (i) contained in child-resistant packaging, as defined in 4.1-600; (ii) equipped with a label that states, in English and in a font no less than 1/16 of an inch, (a) that the substance contains tetrahydrocannabinol and may not be sold to persons younger than 21 years of age, (b) all ingredients contained in the substance, (c) the amount of such substance that constitutes a single serving, and (d) the total percentage and milligrams of tetrahydrocannabinol included in the substance and the number of milligrams of tetrahydrocannabinol that are contained in each serving; and (iii) accompanied by a certificate of analysis, produced by an independent laboratory that is accredited pursuant to standard ISO/IEC 17025 of the International Organization of Standardization by a third-party accrediting body, that states the tetrahydrocannabinol concentration of the substance or the tetrahydrocannabinol concentration of the batch from which the substance originates. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.) or (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1;
366	366
367	367	72. Manufacturing, offering for sale at retail, or selling at retail an industrial hemp extract, as defined in 3.2-5145.1, a food containing an industrial hemp extract, or a substance containing tetrahydrocannabinol that depicts or is in the shape of a human, animal, vehicle, or fruit;
368	368
369	369	73. Selling or offering for sale any substance intended for human consumption, orally or by inhalation, that contains tetrahydrocannabinol and, without authorization, bears, is packaged in a container or wrapper that bears, or is otherwise labeled to bear the trademark, trade name, famous mark as defined in 15 U.S.C. 1125, or other identifying mark, imprint, or device, or any likeness thereof, of a manufacturer, processor, packer, or distributor of a product intended for human consumption other than the manufacturer, processor, packer, or distributor that did in fact so manufacture, process, pack, or distribute such substance;
370	370
371	371	74. Selling or offering for sale a topical hemp product, as defined in 3.2-4112, that does not include a label stating that the product is not intended for human consumption. This subdivision shall not (i) apply to products that are approved for marketing by the U.S. Food and Drug Administration and scheduled in the Drug Control Act ( 54.1-3400 et seq.), (ii) be construed to prohibit any conduct permitted under Chapter 16 ( 4.1-1600 et seq.) of Title 4.1, or (iii) apply to topical hemp products that were manufactured prior to July 1, 2023, provided that the person provides documentation of the date of manufacture if requested;
372	372
373	373	75. Violating any provision of 59.1-466.8;
374	374
375	375	76. Violating subsection F of 36-96.3:1;
376	376
377	377	77. Selling or offering for sale (i) any kratom product to a person younger than 21 years of age or (ii) any kratom product that does not include a label listing all ingredients and with the following guidance: "This product may be harmful to your health, has not been evaluated by the FDA, and is not intended to diagnose, treat, cure, or prevent any disease." As used in this subdivision, "kratom" means any part of the leaf of the plant Mitragyna speciosa or any extract thereof;
378	378
379	379	78. Advertising of any ignition interlock system in Virginia by an ignition interlock vendor not approved by the Commission on the Virginia Alcohol Safety Action Program to operate in Virginia; targeted advertising of any ignition interlock system to a person before determination of guilt; and any advertising, whether before or after determination of guilt, without a conspicuous statement that such advertisement is not affiliated with any government agency. For purposes of this subdivision, "ignition interlock system" has the same meaning as ascribed to that term in 18.2-270.1 and "targeted advertising" has the same meaning ascribed to that term in 59.1-575 and includes direct mailings to an individual. This provision shall not apply to ignition interlock service vendor ads, pamphlets, or kiosk advertisements approved by the Commission on the Virginia Alcohol Safety Action Program and provided at a Commission-approved location;
380	380
381	381	79. Failing to disclose the total cost of a good or continuous service, as defined in 59.1-207.45, to a consumer, including any mandatory fees or charges, prior to entering into an agreement for the sale of any such good or provision of any such continuous service;
382	382
383	383	80. Violating any provision of the Unfair Real Estate Service Agreement Act ( 55.1-3200 et seq.);
384	384
385	385	81. Selling or offering for sale services as a professional mold remediator to be performed upon any residential dwelling without holding a mold remediation certification from the Institute of Inspection, Cleaning and Restoration Certification (IICRC);
386	386
387	387	82. Willfully violating any provision of 59.1-444.4; and
388	388
389	389	83. Violating any provision of Chapter 23.2 ( 59.1-293.10 et seq.); and
390	390
391	391	84. Violating any provision of the Artificial Intelligence Training Data Transparency Act ( 59.1-607 et seq.).
392	392
393	393	B. Nothing in this section shall be construed to invalidate or make unenforceable any contract or lease solely by reason of the failure of such contract or lease to comply with any other law of the Commonwealth or any federal statute or regulation, to the extent such other law, statute, or regulation provides that a violation of such law, statute, or regulation shall not invalidate or make unenforceable such contract or lease.
394	394
395	395	59.1-575. Definitions.
396	396
397	397	As used in this chapter, unless the context requires a different meaning:
398	398
399	399	"Adolescent" means any natural person that is at least 13 years of age but younger than 16 years of age.
400	400
401	401	"Affiliate" means a legal entity that controls, is controlled by, or is under common control with another legal entity or shares common branding with another legal entity. For the purposes of this definition, "control" or "controlled" means (i) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company; (ii) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or (iii) the power to exercise controlling influence over the management of a company.
402	402
403	403	"Authenticate" means verifying through reasonable means that the consumer, entitled to exercise his consumer rights in 59.1-577, is the same consumer exercising such consumer rights with respect to the personal data at issue.
404	404
405	405	"Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is are used to identify a specific individual. "Biometric data" does not include a physical or digital photograph, a video or audio recording or data generated therefrom, unless such data is generated for the purpose of uniquely identifying a natural person, or information collected, used, or stored for health care treatment, payment, or operations under HIPAA.
406	406
407	407	"Business associate" means the same meaning as the term established by HIPAA.
408	408
409	409	"Child" means any natural person younger than 13 years of age.
410	410
411	411	"Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
412	412
413	413	"Consumer" means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.
414	414
415	415	"Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.
416	416
417	417	"Covered entity" means the same as the term is established by HIPAA.
418	418
419	419	"Decisions that produce legal or similarly significant effects concerning a consumer" means a decision made by the controller that results in the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities, such as food and water.
420	420
421	421	"De-identified data" means data that cannot reasonably be linked to an identified or identifiable natural person, or a device linked to such person. A controller that possesses "de-identified data" shall comply with the requirements of subsection A of 59.1-581.
422	422
423	423	"Health record" means the same as that term is defined in 32.1-127.1:03.
424	424
425	425	"Health care provider" means the same as that term is defined in 32.1-276.3.
426	426
427	427	"HIPAA" means the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d et seq.).
428	428
429	429	"Identified or identifiable natural person" means a person who can be readily identified, directly or indirectly.
430	430
431	431	"Institution of higher education" means a public institution and private institution of higher education, as those terms are defined in 23.1-100.
432	432
433	433	"Nonprofit organization" means any corporation organized under the Virginia Nonstock Corporation Act ( 13.1-801 et seq.) or any organization exempt from taxation under 501(c)(3), 501(c)(6), or 501(c)(12) of the Internal Revenue Code, any political organization, any organization exempt from taxation under 501(c)(4) of the Internal Revenue Code that is identified in 52-41, and any subsidiary or affiliate of entities organized pursuant to Chapter 9.1 ( 56-231.15 et seq.) of Title 56.
434	434
435	435	"Online service, product, or feature" means any service, product, or feature that is provided online. "Online service, product, or feature" does not include telecommunications service, as defined in 47 U.S.C. 153, broadband Internet access service, as defined in 47 C.F.R. 54.400, or delivery or use of a physical product.
436	436
437	437	"Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.
438	438
439	439	"Political organization" means a party, committee, association, fund, or other organization, whether or not incorporated, organized and operated primarily for the purpose of influencing or attempting to influence the selection, nomination, election, or appointment of any individual to any federal, state, or local public office or office in a political organization or the election of a presidential/vice-presidential elector, whether or not such individual or elector is selected, nominated, elected, or appointed.
440	440
441	441	"Precise geolocation data" means information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. "Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
442	442
443	443	"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
444	444
445	445	"Processor" means a natural or legal entity that processes personal data on behalf of a controller.
446	446
447	447	"Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
448	448
449	449	"Protected health information" means the same as the term is established by HIPAA.
450	450
451	451	"Pseudonymous data" means personal data that cannot be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
452	452
453	453	"Publicly available information" means information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.
454	454
455	455	"Sale of personal data" means the exchange of personal data for monetary or other valuable consideration by the controller to a third party. "Sale of personal data" does not include:
456	456
457	457	1. The disclosure of personal data to a processor that processes the personal data on behalf of the controller;
458	458
459	459	2. The disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer;
460	460
461	461	3. The disclosure or transfer of personal data to an affiliate of the controller;
462	462
463	463	4. The disclosure of information that the consumer (i) intentionally made available to the general public via a channel of mass media and (ii) did not restrict to a specific audience; or
464	464
465	465	5. The disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.
466	466
467	467	"Sensitive data" means a category of personal data that includes:
468	468
469	469	1. Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status;
470	470
471	471	2. The processing of genetic or biometric data for the purpose of uniquely identifying a natural person;
472	472
473	473	3. The personal data collected from a known child; or
474	474
475	475	4. Precise geolocation data.
476	476
477	477	"State agency" means the same as that term is defined in 2.2-307.
478	478
479	479	"Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict such consumer's preferences or interests. "Targeted advertising" does not include:
480	480
481	481	1. Advertisements based on activities within a controller's own websites or online applications;
482	482
483	483	2. Advertisements based on the context of a consumer's current search query, visit to a website, or online application;
484	484
485	485	3. Advertisements directed to a consumer in response to the consumer's request for information or feedback; or
486	486
487	487	4. Processing personal data processed solely for measuring or reporting advertising performance, reach, or frequency.
488	488
489	489	"Third party" means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.
490	490
491	491	59.1-577. Personal data rights; consumers.
492	492
493	493	A. A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right:
494	494
495	495	1. To confirm whether or not a controller is processing the consumer's personal data and to access such personal data;
496	496
497	497	2. To correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data;
498	498
499	499	3. To delete personal data provided by or obtained about the consumer;
500	500
501	501	4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
502	502
503	503	5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A consumer may authorize a third party, acting on the consumer's behalf, to opt out of the processing of the consumer's personal data for the purposes described in this subdivision. Such authorization may be made using technology that indicates the consumer's intent to opt out, including a browser setting, browser extension, global device setting, or other user-selected universal opt-out mechanism. For the purposes of this subdivision, the user-selected universal opt-out mechanism shall:
504	504
505	505	a. Not unfairly disadvantage a controller;
506	506
507	507	b. Require the consumer to make an affirmative, freely given, and unambiguous choice to opt out of any processing of a consumer's personal data;
508	508
509	509	c. Be easy to use by the average consumer;
510	510
511	511	d. Be consistent with state and federal laws and regulations; and
512	512
513	513	e. Allow the controller to accurately determine whether the consumer has made a legitimate request to opt out under this subdivision 5.
514	514
515	515	B. Except as otherwise provided in this chapter, a controller shall comply with a request by a consumer to exercise the consumer rights authorized pursuant to subsection A as follows:
516	516
517	517	1. A controller shall respond to the consumer without undue delay, but in all cases within 45 days of receipt of the request submitted pursuant to the methods described in subsection A. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.
518	518
519	519	2. If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, but in all cases and at the latest within 45 days of receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision pursuant to subsection C.
520	520
521	521	3. Information provided in response to a consumer request shall be provided by a controller free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.
522	522
523	523	4. If a controller is unable to authenticate the request using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action under subsection A and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.
524	524
525	525	5. A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data pursuant to subdivision A 3 by either (i) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted from the business's records and not using such retained data for any other purpose pursuant to the provisions of this chapter or (ii) opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of this chapter.
526	526
527	527	6. If a consumer's decision to authorize a third party to act on his behalf to opt out of the processing of his personal data pursuant to subdivision A 5 conflicts with the consumer's existing privacy setting with a controller or voluntary participation in a controller's bona fide loyalty, rewards, premium features, discounts, or club card program, the controller shall comply with the consumer's opt-out but may notify the consumer of the conflict and provide the consumer with the choice to confirm his preferred privacy setting.
528	528
529	529	7. If a controller charges a fee for the use of a user-selected universal opt-out mechanism as described in subdivision A 5, the controller shall inform a consumer attempting to use such mechanism of such fee.
530	530
531	531	C. A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision pursuant to subdivision B 2. The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to subsection A. Within 60 days of receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, the controller shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.
532	532
533	533	59.1-578. Data controller responsibilities; transparency.
534	534
535	535	A. A controller shall:
536	536
537	537	1. Limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer;
538	538
539	539	2. Except as otherwise provided in this chapter, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent;
540	540
541	541	3. Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. Such data security practices shall be appropriate to the volume and nature of the personal data at issue;
542	542
543	543	4. Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers. A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in this chapter, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services to the consumer. However, nothing in this subdivision shall be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised his right to opt out pursuant to 59.1-577 or the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program; and
544	544
545	545	5. Not process sensitive data concerning a consumer, including an adolescent consumer, without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. 6501 et seq.).
546	546
547	547	B. Any provision of a contract or agreement of any kind that purports to waive or limit in any way consumer rights pursuant to 59.1-577 shall be deemed contrary to public policy and shall be void and unenforceable.
548	548
549	549	C. Controllers shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:
550	550
551	551	1. The categories of personal data processed by the controller;
552	552
553	553	2. The purpose for processing personal data;
554	554
555	555	3. How consumers may exercise their consumer rights pursuant 59.1-577, including how a consumer may appeal a controller's decision with regard to the consumer's request;
556	556
557	557	4. The categories of personal data that the controller shares with third parties, if any; and
558	558
559	559	5. The categories of third parties, if any, with whom the controller shares personal data.
560	560
561	561	D. If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing.
562	562
563	563	E. A controller shall establish, and shall describe in a privacy notice, one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identity of the consumer making the request. Controllers shall not require a consumer to create a new account in order to exercise consumer rights pursuant to 59.1-577 but may require a consumer to use an existing account.
564	564
565	565	F. 1. Subject to the consent requirement established by subdivision 3, no controller shall process any personal data collected from a known child:
566	566
567	567	a. For the purposes of (i) targeted advertising, (ii) the sale of such personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer;
568	568
569	569	b. Unless such processing is reasonably necessary to provide the online service, product, or feature;
570	570
571	571	c. For any processing purpose other than the processing purpose that the controller disclosed at the time such controller collected such personal data or that is reasonably necessary for and compatible with such disclosed purpose; or
572	572
573	573	d. For longer than is reasonably necessary to provide the online service, product, or feature.
574	574
575	575	2. Subject to the consent requirement established by subdivision 3, no controller shall collect precise geolocation data from a known child unless (i) such precise geolocation data is reasonably necessary for the controller to provide an online service, product, or feature and, if such data is necessary to provide such online service, product, or feature, such controller shall only collect such data for the time necessary to provide such online service, product, or feature and (ii) the controller provides to the known child a signal indicating that such controller is collecting such precise geolocation data, which signal shall be available to such known child for the entire duration of such collection.
576	576
577	577	3. No controller shall engage in the activities described in subdivisions 1 or 2 unless the controller obtains consent from the child's parent or legal guardian in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. 6501 et seq.).
578	578
579	579	G. 1. Subject to the consent requirement established by subdivision 3 and where a controller has actual knowledge or willfully disregards that a consumer is an adolescent, no controller shall process any personal data collected from such adolescent:
580	580
581	581	a. For the purposes of (i) targeted advertising, (ii) the sale of such personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer;
582	582
583	583	b. Unless such processing is reasonably necessary to provide the online service, product, or feature;
584	584
585	585	c. For any processing purpose other than the processing purpose that the controller disclosed at the time such controller collected such personal data or that is reasonably necessary for and compatible with such disclosed purpose; or
586	586
587	587	d. For longer than is reasonably necessary to provide the online service, product, or feature.
588	588
589	589	2. Subject to the consent requirement established by subdivision 3 and where a controller has actual knowledge or willfully disregards that a consumer is an adolescent, no controller shall collect precise geolocation data from such adolescent unless (i) such precise geolocation data is reasonably necessary for the controller to provide an online service, product, or feature and, if such data is necessary to provide such online service, product, or feature, such controller shall only collect such data for the time necessary to provide such online service, product, or feature and (ii) the controller provides to the adolescent a signal indicating that such controller is collecting such precise geolocation data, which signal shall be available to such adolescent for the entire duration of such collection.
590	590
591	591	3. No controller shall engage in the activities described in subdivision 1 or 2 unless the controller obtains consent from the adolescent consumer.
592	592
593	593	59.1-584. Enforcement; civil penalty; expenses.
594	594
595	595	A. The Attorney General shall have exclusive authority to enforce the provisions of this chapter.
596	596
597	597	B. Prior to initiating any action under this chapter, the Attorney General shall may provide a controller or processor 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated. If within the 30-day period the controller or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the controller or processor.
598	598
599	599	C. The Attorney General, in determining whether to grant a controller or processor the opportunity to cure an alleged violation of this chapter, shall give due consideration to:
600	600
601	601	1. The controller's or processor's history of previous violations of this chapter;
602	602
603	603	2. The size and complexity of the controller or processor;
604	604
605	605	3. The nature and extent of the controller's or processor's processing activities;
606	606
607	607	4. The substantial likelihood of injury to the public as a result of the alleged violation;
608	608
609	609	5. The safety of persons or property after the alleged violation;
610	610
611	611	6. Whether the alleged violation was likely caused by human or technical error; and
612	612
613	613	7. The demonstrated good faith of the controller or processor in attempting to achieve compliance with this chapter.
614	614
615	615	D. If a controller or processor continues to violate violates this chapter following, fails to cure a noticed violation within the cure period in subsection B, or breaches an express written statement provided to the Attorney General under that subsection, the Attorney General may initiate an action in the name of the Commonwealth and may seek an injunction to restrain any violations of this chapter and civil penalties of up to $7,500 for each violation under this chapter. All civil penalties, expenses, and attorney fees collected pursuant to this chapter shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.
616	616
617	617	D. E. The Attorney General may recover reasonable expenses incurred in investigating and preparing the case, including attorney fees, in any action initiated under this chapter.
618	618
619	619	E. F. Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of this chapter or under any other law.
620	620
621	621	CHAPTER 58.
622	622
623	623	ARTIFICIAL INTELLIGENCE TRAINING DATA TRANSPARENCY ACT.
624	624
625	625	59.1-607. Definitions.
626	626
627	627	"Artificial intelligence" means a set of technologies that enables machines to perform tasks under varying and unpredictable circumstances that typically require human oversight or intelligence, or that can learn from experience and improve performance when exposed to data sets.
628	628
629	629	"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system received how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.
630	630
631	631	"Developer" means any person doing business in the Commonwealth that develops or significantly updates an artificial intelligence system that is offered, sold, leased, given, or otherwise provided to consumers in the Commonwealth.
632	632
633	633	"Do Not Train data" means any data whose owner or publisher has affirmatively asserted that the data should not be used for training an artificial intelligence system.
634	634
635	635	"Generative artificial intelligence" means artificial intelligence based on a foundation model that is capable of and used to produce synthetic digital content, including audio, images, text, and videos.
636	636
637	637	"Generative artificial intelligence system or service" means any artificial intelligence system or service that incorporates generative artificial intelligence.
638	638
639	639	"Personal data" means the same as that term is defined in 59.1-575.
640	640
641	641	"Preprocessing" means any cleaning, processing, or other modification of data prior to usage.
642	642
643	643	"Primary content owner" means (i) a person, partnership, or company that owns, in full or in part, digital data, content, or objects that are subject to copyright protection or (ii) a natural person with personally identifiable information.
644	644
645	645	"Publicly available mechanism" means a mechanism that is lawfully made available to the general public by a developer or other entity through wide distribution, unless the mechanism is restricted to a specific audience.
646	646
647	647	"Security or integrity" means the ability of (i) networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; (ii) businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions, and help prosecute those responsible for such actions; and (iii) businesses to ensure the physical safety of natural persons.
648	648
649	649	"Significant update" means any new version, new release, or other update to a generative artificial intelligence system or service that results in significant changes to such system's or service's use case or key functionality, including the results of retraining or fine-tuning.
650	650
651	651	"Synthetic data generation" means a process in which seed data are used to create artificial data by using a generative artificial intelligence system or service.
652	652
653	653	"Synthetic digital content" means any digital content, including any audio, image, text, or video, that is produced or manipulated by a generative artificial intelligence system or service, including a general-purpose artificial intelligence model.
654	654
655	655	"Train a generative artificial intelligence system or service" includes, in addition to initial data set training, further testing, validating, or fine-tuning by the developer of the generative artificial intelligence system or service.
656	656
657	657	"Training Data Deletion Request" or "TDDR" means a mechanism by which a primary content owner submits a request to a developer to delete content that was or will be ingested by or included in a generative artificial intelligence training data set.
658	658
659	659	"Training Data Verification Request" or "TDVR" means a mechanism by which a primary content owner submits a request to a developer to verify if the owner's content was ingested by or included in a generative artificial intelligence training data set.
660	660
661	661	59.1-608. Transparency and disclosure requirements.
662	662
663	663	A. A developer of a generative artificial intelligence system or service that is made available in the Commonwealth for use, regardless of whether the terms of that use include compensation, shall post on the developer's website the following information about the generative artificial intelligence training data set used to train the generative artificial intelligence system or service:
664	664
665	665	1. A description of each data set used in the development of such system or service, including:
666	666
667	667	a. The name of the data set;
668	668
669	669	b. The source or owner of the data set;
670	670
671	671	c. The approximate amount of data included in the data set;
672	672
673	673	d. A statement of whether the data set includes any data protected by copyright, trademark, or patent;
674	674
675	675	e. A description of any steps taken to manage copyrighted, trademarked, or patented data, including whether the data set was purchased or licensed by the developer and whether such data set has been preprocessed to filter copyrighted, trademarked, or patented data;
676	676
677	677	f. A statement of whether the data set includes any Do Not Train data;
678	678
679	679	g. A description of any steps taken to manage Do Not Train data, including whether the data set was purchased or licensed by the developer and whether such data set has been preprocessed to filter Do Not Train data;
680	680
681	681	h. A statement of whether the data set includes personal data;
682	682
683	683	i. A description of any steps taken to manage personal data, including whether the data set has been preprocessed to filter personal data, whether individuals were given the opportunity to opt out of their data being used to train a generative artificial intelligence system or service, whether notice was given to individuals that their data was being used to train a generative artificial intelligence system or service, and whether personal data collected prior to an opt-out is included;
684	684
685	685	j. A statement of whether the data set includes any illegal materials;
686	686
687	687	k. A description of any steps taken to manage illegal materials, including whether the data set has been preprocessed to filter illegal materials;
688	688
689	689	l. The time period during which the data in the data set was collected, including a notice if the data collection is ongoing; and
690	690
691	691	m. A disclosure that the generative artificial intelligence system or service uses synthetic data generation in its development.
692	692
693	693	2. The disclosures required by this chapter to the extent that they derive from the generative artificial intelligence system or service that is used during synthetic data generation.
694	694
695	695	B. A developer of a generative artificial intelligence system or service shall publish the disclosures required by this section no later than 72 hours after such system or service is made available for use in the Commonwealth.
696	696
697	697	C. After a significant update has been made to a generative artificial intelligence system or service, the developer of such system or service shall update the published disclosures required by this section no later than 72 hours after the updated system or service is made available for use in the Commonwealth.
698	698
699	699	D. No developer shall be required to post documentation regarding the data used to train a generative artificial intelligence system or service that has the sole purpose of ensuring security or integrity.
700	700
701	701	59.1-609. Developer duties.
702	702
703	703	A. A developer shall keep detailed records of the generative artificial intelligence data set used to train a generative artificial intelligence system or service. A developer shall be deemed compliant with this subsection if the developer adheres to the latest version of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology, Standard ISO/IEC 42001 of the International Organization for Standardization, or another nationally or internationally recognized risk management framework for artificial intelligence systems or parts thereof.
704	704
705	705	B. A developer shall provide a clearly designated and publicly available mechanism for the submission of Training Data Verification Requests and shall provide verification pursuant to a TDVR within 30 days of receiving such a request.
706	706
707	707	C. A developer shall provide a clearly designated and publicly available mechanism for the submission of Training Data Deletion Requests and shall delete content pursuant to a TDDR within 30 days of receiving such a request. A developer shall delete content pursuant to a TDDR for all future versions of a generative artificial intelligence system or service.
708	708
709	709	59.1-610. Nondisclosure or confidentiality agreement.
710	710
711	711	A. No developer shall require an employee or a prospective employee to execute or renew any provision in a nondisclosure or confidentiality agreement, including any provision relating to nondisparagement, that has the purpose or effect of concealing the details relating to a claim of noncompliance with this chapter. Any such provision is against public policy and is void and unenforceable.
712	712
713	713	B. This section shall in no way limit other grounds that exist at law or in equity for the unenforceability of any such agreement or any provision of such agreement.
714	714
715	715	59.1-611. Enforcement; right to cure.
716	716
717	717	A. Any violation of this chapter shall constitute a prohibited practice under the provisions of 59.1-200 and shall be subject to the enforcement provisions of the Virginia Consumer Protection Act ( 59.1-196 et seq.).
718	718
719	719	B. 1. Prior to initiating an enforcement action for a violation of this chapter, the Attorney General may provide a developer 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated. If within the 30-day period the developer cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the developer.
720	720
721	721	2. The Attorney General, in determining whether to grant a developer the opportunity to cure an alleged violation of this chapter, shall give due consideration to:
722	722
723	723	a. The developer's history of previous violations of this chapter;
724	724
725	725	b. The size and complexity of the developer;
726	726
727	727	c. The nature and complexity of the developer's generative artificial intelligence system or service;
728	728
729	729	d. The substantial likelihood of injury to the public as a result of the alleged violation;
730	730
731	731	e. The safety of persons or property after the alleged violation;
732	732
733	733	f. Whether the alleged violation was likely caused by human or technical error; and
734	734
735	735	g. The demonstrated good faith of the developer in attempting to achieve compliance with this chapter.
736	736
737	737	C. Any person or entity claiming to be injured due to a violation of this chapter shall be entitled to initiate an action to recover monetary damages pursuant to 59.1-204 or to obtain injunctive or any other available equitable relief. In granting equitable relief, the court may award reasonable attorney fees and costs to the person or entity injured.
738	738
739	739	2. That the provisions of 59.1-584 of the Code of Virginia, as amended by this act, shall become effective on January 1, 2026.
740	740
741	741	3. That the provisions of 59.1-200 of the Code of Virginia, as amended by this act, and 59.1-607 through 59.1-611 of the Code of Virginia, as created by this act, shall become effective on July 1, 2026.