Va. Kids' Privacy Bill Advances as Tech Groups Balk

Virginia legislators voted 16-6 at a House Communications, Technology and Innovation Committee meeting to advance HB-1688 by Chair Emily Brewer (R). It would require websites to obtain verifiable parental consent before collecting, using or disclosing personal data of children. It would prohibit controllers from knowingly processing a child’s personal data for targeted advertising, data sale or “profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer,” said a fiscal summary. Also, the bill would redefine children as those under 18, up from 13 as defined in the Virginia Consumer Data Protection Act.

"We know that children are absolutely deeply influenced by what they see online,” said Brewer at the livestreamed hearing. “Data collection of minors is a serious issue.” Targeted ads based on children’s internet activity can be harmful, and HB-1688 would ensure minors’ data isn't sold or marketed, said Brewer, who also has a bill to ban TikTok on state government devices (see 2301230011). Vice Chair James Edmunds (R) voted to advance the bill after the committee voted 15-5 against his motion to further study the bill with a plan of bringing back the children’s measure next year.

Democrats cast all six no votes, though some from that party supported the Republican bill. Voting yes, Del. Danica Roem (D) stressed the bill would restrict usage of children’s data but not access to websites. Del. Dan Helmer (D) also voted to report the bill after asking Brewer to confirm it contains no private right of action.

Tech industry groups lined up in opposition to HB-1688 at the hearing. The Children’s Online Privacy Protection Act (COPPA) preempts the proposed law, said NetChoice Director-State and Federal Affairs Amy Bos, noting California’s children’s privacy law faces litigation. Bos urged legislators instead to support two other Virginia bills: HB-1391 to establish a commission to study social media impacts and HB-1575, cleared 8-0 Friday by a House subcommittee, to create educational programs about online safety. Bos and lobbyists for TechNet and the State Privacy and Security Coalition (SPSC) noted Virginia’s comprehensive privacy law took effect just this month. “Let the current privacy law work before amending it,” said Bos.

HB-1688 has practical problems, the tech lobbyists said. Virginia’s bill doesn’t say how businesses would determine age, said Bos: They would probably have to collect even more personal information to confirm a child’s age, possibly including social security numbers or passports. SPSC General Counsel Andrew Kingman said the proposed requirements would degrade the user experience with more pop-ups to collect consent.

In a 9-6 vote last week, another committee “passed by indefinitely” the Virginia Senate's version (SB-1026) of the bill. The legislative maneuver can signal a bill's defeat, but it doesn't stop the committee from bringing back the bill before its deadline.

“In 2023, more states are following California’s lead and introducing bills that seek to regulate private entities’ processing of children’s data,” Husch Blackwell lawyers blogged last week. States with children’s privacy bills include New Jersey, Oregon, Texas, Virginia and West Virginia, shows the firm’s bill tracker.

NetChoice claimed in its December lawsuit the California children’s privacy bill violated the First Amendment by telling sites how to “manage constitutionally protected speech.” Also, the state law contradicts COPPA and violates the Fourth Amendment, the group told the U.S. District Court of Northern California (case 5:22-cv-8861).