Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

VA HB638: Data brokers; regulation, civil penalties.

In Committee Virginia · 2026 session

Last verified Oct 14, 2026 · official bill text

HB638 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Virginia's HB 638 (2026 Regular Session) would regulate data brokers. It would bar acquiring personally identifiable information by fraud, or to stalk, harass, commit fraud or unlawfully discriminate; require data brokers to keep an information security program; and require annual registration with the Secretary of the Commonwealth beginning December 1, 2027. Continued to 2027 in committee on February 9, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Not law. If enacted, data brokers would need security programs and annual registration starting December 1, 2027, and could face Consumer Protection Act enforcement.

Key provisions

  1. Would add Chapter 60 (§§ 59.1-614 through 59.1-619) to Title 59.1, Data Broker Regulation
  2. Would prohibit acquiring personally identifiable information through fraud, or to stalk or harass, commit fraud or engage in unlawful discrimination
  3. A data broker would have to develop, implement and maintain a comprehensive information security program
  4. Data brokers operating in Virginia would have to register with the Secretary of the Commonwealth beginning December 1, 2027, and annually after
  5. As introduced, a violation would be a prohibited practice under the Virginia Consumer Protection Act
  6. The committee substitute defines "artificial intelligence system" and "biometric data" among its terms
  7. The bill as introduced had a delayed effective date of July 1, 2027; subcommittee substitute offered February 4, 2026; continued to 2027 in committee on February 9, 2026

Latest legislative action

Feb 9, 2026. Continued to 2027 in Communications, Technology and Innovation (Voice Vote)

Sponsors (showing 5 of 10)

NameRole
D Primary
Primary
Primary
D Primary
Primary

Topics and industries

Related topics

AI Privacy

Affected industries

TechnologyConsumer Protection

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error

Related AI laws in Virginia

All Virginia bills →
HB1186 Artificial intelligence; use of systems for student instruction. SB394 Artificial intelligence; use of systems for student instruction. HB635 Artificial Intelligence Chatbots Act; established, prohibited practices, penalti SB85 Consumer Data Protection Act; social media platforms & model operators, interope SJR14 Artificial intelligence; Joint Commission on Technology and Science to study adv HB2250 Artificial Intelligence Training Data Transparency Act; transparency and disclos

Same topic in other states

Vermont H0211 An act relating to data brokers and personal information California AB1159 Student personal information. Maine LD1585 An Act To Increase Privacy and Security by Regulating the Use of Facial Surveill Connecticut SB1295 An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Idaho S1227 Adds to existing law to establish provisions regarding generative artificial int South Carolina H3431 South Carolina Social Media Regulation Act