HB638
Regulation of data brokers; civil penalties
Status:
In House
Latest Action:
Feb. 4, 2026
House: Subcommittee recommends continuing to (Voice Vote)
Chief Patron:
Michelle Maldonado (D)
Session:
2026 Regular Session
Summary
As Introduced. Regulation of data brokers
; civil penalties. Prohibits a person from acquiring personally identifiable information, defined in the bill, through fraudulent means or acquiring and using such information for the purpose of (i) stalking or harassing another person; (ii) committing a fraud, including identity theft, financial fraud, or email fraud; or (iii) engaging in ... (More) unlawful discrimination, including employment discrimination or housing discrimination. The bill requires a data broker, defined in the bill, to develop, implement, and maintain a comprehensive information security program that includes certain features and technical elements. The bill also requires a data broker operating in the Commonwealth, beginning on December 1, 2027, and annually thereafter, to register with the Secretary of the Commonwealth. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act. The bill has a delayed effective date of July 1, 2027. (Less)-
Bill History
- 01/13/2026 - House: Prefiled and ordered printed; Offered 01-14-2026 26105301D
- 01/13/2026 - House: Referred to Committee on Communications, Technology and Innovation
- 01/26/2026 - House: Assigned HST sub: Technology and Innovation
- 01/27/2026 - House: Placed on Communications, Technology and Innovation Agenda
- 02/03/2026 - House: Placed on Communications, Technology and Innovation Agenda
- 02/04/2026 - House: House subcommittee offered
- 02/04/2026 - House: Subcommittee recommends continuing to (Voice Vote)
