Virginia Amends Data Privacy Law To Impose New Restrictions on Social Media Platforms

On May 2, 2025, Virginia Governor Glenn Youngkin signed Senate Bill 854 (SB854) into law, which imposes new restrictions and compliance obligations on social media platforms. Specifically, SB854 amends the Virginia Consumer Data Protection Act (VCDPA) and requires social media platforms to deploy “commercially reasonable methods,” such as neutral age screen mechanisms, to assess whether a user of a platform is under the age of 16. If a platform identifies such a user, it must impose limits on the use of its application or platform to one hour per day. In addition, social media platforms must allow a parent of a minor to provide verifiable parental consent to increase or decrease this daily time limit.

The social media restrictions are scheduled to go into effect on January 1, 2026.

Overview of SB854

SB854 applies to any “social media platform” which is defined as a “public or semipublic Internet-based service or application that has users in the Commonwealth” and that meets the following criteria:

1. Connects users to allow users to interact socially with each other within such service or application; and
2. Allows users to do all the following:
   1. Construct a public or semipublic profile for purposes of signing into and using such service or application;
   2. Populate a public list of other users with whom such user shares a social connection within such service or application; and
   3. Create or post content viewable by other users, including content on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.

When social media platforms conduct an age assessment of a user (to determine whether the daily one-hour limitation is triggered), the platform is restricted from using collected information “for any purpose other than age determination and provision of age-appropriate experiences.”

In addition, social media platforms are prohibited from withholding, degrading, lowering the quality of, or increasing the price of any online service, product, or feature to a user due to the controller or processor not being permitted to provide use of such social media platform beyond the one hour per day limit.

Child vs. Minor Distinction Could Create Compliance Challenges

According to Virginia Code § 59.1-577.1 (the new section added to the VCDPA), social media platforms will be subject to certain “responsibilities and prohibitions related to minors.” Notably, once SB854 goes into effect, there will be different definitions for a “child” versus a “minor” under the VCDPA. Specifically, a “child” is defined as “any natural person younger than 13 years of age.” In contrast, a “minor” is defined as “any natural person younger than 16 years of age.” Does this mean a 12-year-old is both a “child” and a “minor” under the Virginia law? If so, compliance challenges may arise for social media platforms considering the broader text of the VCDPA. Specifically, § 59.1-576(D) of the VCDPA generally exempts businesses that “comply with the verifiable parental consent requirements of the Children's Online Privacy Protection Act (COPPA).” In effect, if a business complies with the consent regulations set forth by the COPPA – which are triggered when information about a child (i.e., younger than age 13) is involved - that information is exempt from the VCDPA’s jurisdictional orbit. If a user of a social media platform is identified as younger than age 13, and the platform complies with COPPA’s consent requirements to meet the VCDPA exemption, does the platform still need to impose a daily one-hour limit on that user to comply with SB854? The answer is currently unclear. One possibility is that social media platforms may need to actively monitor and assess users between the ages of 14 and 16, while continuing to adhere to COPPA regulations for users age 13 and younger.

SB854 Could Be Subject to Legal Challenges

Similar restrictions imposed on social media platforms have not fared well when challenged in court. For example, in 2023, the Governor of Utah signed a law requiring age verification and parental consent for minors to use social media platforms. Specifically, the law limited social media use for anyone under the age of 18 and prohibited minors from accessing applications between the hours of 10:30 p.m. and 6:30 a.m., unless they could secure verifiable parental consent.

The Utah law was quickly challenged in court on First Amendment grounds. In September 2024, a federal court judge blocked the Utah law from being enforced. The federal court reasoned that Utah failed to provide sufficient evidence establishing a “clear, causal relationship between minors' social media use and negative mental health impacts," according to Axios.

A similar legal challenge could potentially be mounted against the provisions of SB854 based on parallel free speech grounds.

SB854 Adds to Virginia Legislation Focused on Children’s Data Privacy and Online Protections

SB854 could be viewed as a concerted effort by the Virginia legislature to establish guardrails around children’s personal data and online protections, particularly when children access social media platforms. For example, SB854 follows new children’s data privacy requirements that were signed into law on May 17, 2024, by Governor Youngkin. The VCDPA was amended by Senate Bill 361 (SB 361) in 2024 to impose additional requirements on businesses that process the personal data of a known “child” (a consumer younger than age 13).

Under SB361, unless a business (including social media platforms) first obtains parental consent, they are prohibited from processing personal data collected from a “known child” for targeted advertising, selling personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer. SB361 also prohibits businesses from processing personal data of known children that is not reasonably necessary to provide the online service, product, or feature. Businesses also cannot process children’s personal data for purposes other than those disclosed at the time the business collected the personal data or that are reasonably necessary for and compatible with such disclosed purposes. SB361 went into effect on January 1, 2025.

With SB361 on the books and SB854 coming into effect on January 1, 2026, it is fair to say the regulatory landscape will only become more complex and challenging for social media platforms.

If you have questions about SB854 and social media restrictions coming into effect in Virginia, please contact the authors of this article, your Woods Rogers attorney, or a member of the Woods Rogers Cybersecurity & Data Privacy practice team.