Virginia HB 654: Consumer Data Protection Act; definition of "biometric data"; consent required for processing.

Bill Text

2026 SESSION

INTRODUCED

26103138D

HOUSE BILL NO. 654

Offered January 14, 2026

Prefiled January 13, 2026

A BILL to amend the Code of Virginia by adding a section numbered 59.1-577.2, relating to Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data.

—————

Patrons—Maldonado, Shin, Anderson, Anthony, Clark, Cole, N.T., Feggans, Guzman, Henson, Price and Rasoul

—————

Referred to Committee on Communications, Technology and Innovation

—————

Be it enacted by the General Assembly of Virginia: 

1. That the Code of Virginia is amended by adding a section numbered 59.1-577.2 as follows:

§ 59.1-577.2. Consent required for processing biometric data.

A. For purposes of this section:

"Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, facial feature pattern characteristics, neural data, physiological activities, or other unique biological patterns or characteristics that are used to identify a specific individual. "Biometric data" includes data generated from a physical or digital photograph or a video or audio recording and data stored for health care treatment, payment, or operations under HIPAA.

"Neural data" means data generated by measurements of the activity of an individual's central or peripheral nervous system that can be processed by or with the assistance of technology.

B. No consumer, controller, processor, or affiliate of the controller or processor shall process biometric data concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.).