Virginia Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Virginia regulates biometric data through the Virginia Consumer Data Protection Act, which classifies biometric data processed to identify a person as sensitive personal data under Va. Code 59.1-575 and requires opt-in consent under Va. Code 59.1-578(A)(5) before a business collects fingerprints, voiceprints, or iris scans for identification. Virginia has no general BIPA-style consumer biometric statute, but two narrow provisions operate outside the VCDPA: a fingerprint return-or-destroy duty in business transactions (Va. Code 59.1-478) and biometric-data protections for college student-athletes (Va. Code 23.1-408.2). The VCDPA itself is enforced exclusively by the Attorney General.

Virginia does not have a general-purpose biometric privacy statute like Illinois's BIPA or Texas's CUBI. Instead, Virginia protects biometric data primarily through the Virginia Consumer Data Protection Act (VCDPA), a comprehensive consumer privacy law that classifies biometric identifiers as sensitive data requiring affirmative opt-in consent. Two narrower statutes, covered below, impose biometric duties on their own terms outside that framework.

Governor Ralph Northam signed Senate Bill 1392 into law on March 2, 2021, making Virginia the second state after California to enact a comprehensive consumer data privacy law. The VCDPA took effect on January 1, 2023.

For an overview of Virginia's broader privacy framework, see the parent guide to Virginia Data Privacy Laws.

How the VCDPA Defines Biometric Data

The VCDPA defines biometric data under Va. Code 59.1-575 as data generated by automatic measurements of an individual's biological characteristics that are used to identify a specific individual. The statute lists these examples:

• Fingerprints
• Voiceprints
• Eye retinas
• Irises
• Other unique biological patterns or characteristics

The law draws a clear boundary around what does not qualify. A physical or digital photograph, a video or audio recording, or data generated from those recordings is not biometric data under the VCDPA. Information collected, used, or stored for health care treatment, payment, or operations under HIPAA is also excluded from the definition.

This definition follows the approach used in several other state comprehensive privacy statutes, including Connecticut and Kentucky. It is narrower than the definition used in Illinois's BIPA, which covers a broader set of biometric identifiers without the same exclusions.

Sensitive Data Classification and Consent Requirements

Under the VCDPA, biometric data processed for the purpose of uniquely identifying an individual qualifies as "sensitive data." This is the highest protection category in the law.

Other categories of sensitive data under Va. Code 59.1-575 include:

• Data revealing racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnoses
• Sexual orientation
• Citizenship or immigration status
• Genetic data processed for identification
• Precise geolocation data
• Personal data collected from a known child under 13

Consent requirement. The classification itself lives in the definition of "sensitive data" at Va. Code 59.1-575. The duty that flows from it sits one section later: under Va. Code 59.1-578(A)(5), a controller shall "not process sensitive data concerning a consumer without obtaining the consumer's consent." This means a business cannot collect your fingerprint, faceprint, or iris scan for identification purposes without first asking for and receiving your affirmative agreement.

The VCDPA defines "consent" as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data. A buried clause in a terms-of-service agreement or a pre-checked checkbox does not meet this standard. Consent must involve a deliberate action, such as a written statement or other unambiguous affirmative act.

Who Must Comply With the VCDPA

The VCDPA applies to entities that conduct business in Virginia or produce products or services targeted to Virginia residents and meet one of these thresholds under Va. Code 59.1-576:

• Process personal data of 100,000 or more Virginia consumers during a calendar year, or
• Process personal data of 25,000 or more Virginia consumers and derive over 50% of gross revenue from the sale of personal data

The term "sale" under the VCDPA covers only exchanges for monetary consideration. This is narrower than laws in states like California, which also cover non-monetary exchanges of value.

Key Exemptions

The VCDPA carves out several categories of entities and data types from coverage under Va. Code 59.1-576:

Entity exemptions:

• Virginia state and local government agencies
• Financial institutions subject to the Gramm-Leach-Bliley Act (GLBA)
• Entities covered by HIPAA
• Nonprofit organizations
• Institutions of higher education

Data exemptions:

• Protected health information under HIPAA
• Consumer credit reporting data under the Fair Credit Reporting Act (FCRA)
• Data covered by the Family Educational Rights and Privacy Act (FERPA)
• Data under the Driver's Privacy Protection Act (DPPA)

Employee data exemption. The VCDPA excludes personal data collected in an employment context from coverage. If your employer collects your fingerprints for a timekeeping system or uses facial recognition for building access, the VCDPA does not apply to that collection. Virginia has not enacted a comprehensive law regulating employer use of biometric data, and a bill (HB 1215) proposing employer biometric data protections with a $25,000-per-violation penalty was introduced and left in committee. The fingerprint return-or-destroy duty at Va. Code 59.1-478, described in the next section, is not tied to the VCDPA at all, but it is written around business, commercial, or financial transactions rather than employment, and no Virginia appellate decision applies it to workplace fingerprinting.

Biometric Rules Outside the VCDPA

Two Virginia statutes impose biometric duties independently of the VCDPA. Neither is a general consumer biometric law on the scale of Illinois's BIPA, but both apply on their own terms, without the VCDPA's 100,000-consumer and 25,000-consumer thresholds and without its entity exemptions.

Fingerprints in business transactions. Va. Code 59.1-478 is the whole of Chapter 42 of Title 59.1, "Fingerprinting in Connection with Business Transaction." It provides that whenever any person requires another to furnish a fingerprint in conjunction with any business, commercial or financial transaction, then unless the parties otherwise agree, within twenty-one days of the transaction's completion or termination the original record of those prints and all copies, including electronic or facsimile copies, must be either returned to the person who provided them or destroyed by the person who required and obtained them. The section does not apply to fingerprints affixed to instruments governed by Titles 8.3A and 8.4, which cover negotiable instruments and bank deposits and collections. The provision dates to 1999 and carries no revenue or consumer-count threshold, so it can reach a business far too small to be a VCDPA controller. Virginia courts have not defined the outer edge of "business, commercial or financial transaction," so how far the duty reaches beyond a discrete transaction is untested.

Student-athlete biometric data. Va. Code 23.1-408.2, added by 2026 Va. Acts c. 247, is a dedicated biometric statute for college athletes. It defines biometric data broadly, reaching DNA and imagery of the iris, retina, fingerprint, face, hand, palm, and vein patterns as well as voice recordings. It bars an institution of higher education from disclosing an enrolled student-athlete's biometric data to an outside party without the student-athlete's prior written consent, and it bars anyone from conditioning a name, image, and likeness contract on possession or ownership of the athlete's biometric data unless the athlete gives prior written consent in a writing separate from that contract. Because institutions of higher education are exempt entities under the VCDPA, this section is the operative biometric rule in that setting.

Consumer Rights Over Biometric Data

Because biometric data is sensitive personal data under the VCDPA, Virginia consumers have these rights under Va. Code 59.1-577:

Right to confirm and access. You can ask any covered business whether it is processing your biometric data and request access to that data.

Right to correct. If a business holds inaccurate biometric data about you, you can request a correction.

Right to delete. You can request that a business delete the biometric data it holds about you.

Right to data portability. You can obtain a copy of your biometric data in a portable and readily usable format.

Right to opt out. You can opt out of the processing of your personal data for targeted advertising, data sales, or profiling that produces legal or similarly significant effects.

Right to non-discrimination. Businesses cannot penalize you for exercising any of these rights by denying goods or services, charging different prices, or providing a different quality of service.

Businesses must respond to consumer rights requests within 45 days under the VCDPA. They can extend this period by an additional 45 days when reasonably necessary, but must notify the consumer of the extension and the reason for it. If a business denies your request, you may appeal, and the business must respond to the appeal within 60 days. If the appeal is denied, the business must provide contact information for filing a complaint with the Virginia Attorney General.

Data Protection Assessments for Biometric Data

Controllers that process sensitive data, including biometric data, must conduct data protection assessments under Va. Code 59.1-580. These assessments apply to processing activities created or generated after January 1, 2023.

A data protection assessment must weigh the benefits of the processing against the potential risks to the consumer, including risks of:

• Unfair or deceptive treatment or unlawful disparate impact
• Financial, physical, or reputational injury
• Intrusion upon solitude or seclusion
• Other substantial injury

The Virginia Attorney General can request these assessments through a civil investigative demand. They remain confidential and exempt from public inspection under Virginia's Freedom of Information Act.

Facial Recognition Technology Restrictions

Virginia goes beyond the VCDPA with separate statutes governing government use of facial recognition technology.

State police. Va. Code 52-4.5 gave the Virginia State Police its own authorized-use framework: facial recognition for 14 defined purposes, NIST evaluation with at least 98% true positive accuracy, a bar on real-time tracking, and Class 3 misdemeanor penalties for misuse. That framework was created by 2022 Va. Acts c. 737, the same act that built the local and campus police framework below, and it carried the identical sunset clause: "the provisions of this act shall expire on July 1, 2026." As of this writing, the official Code of Virginia site has not posted a post-sunset version of section 52-4.5, so its current status is unresolved rather than confirmed as continuing.

Local law enforcement. Under Va. Code 15.2-1723.2, local law-enforcement agencies face similar restrictions. Effective July 1, 2026, no local law-enforcement agency may purchase or deploy facial recognition technology unless expressly authorized by statute. The technology must remain under the exclusive control of the agency, and data must be kept confidential and accessible only through search warrants.

Higher education. Under Va. Code 23.1-815.1, campus police departments are also prohibited from purchasing or deploying facial recognition technology unless expressly authorized by statute, effective July 1, 2026.

Breach Notification and Biometric Data

Virginia's breach notification law at Va. Code 18.2-186.6 requires businesses to notify affected individuals and the Attorney General when a security breach compromises unencrypted personal information.

The current definition of "personal information" under the breach notification statute covers a first name or initial and last name combined with a Social Security number, driver's license number, financial account numbers, passport number, or military ID. Biometric data is not specifically listed as a triggering data element under this statute.

However, the breach notification law contains a notable provision for consumers: it explicitly preserves an individual's right to recover direct economic damages from a violation. This means that unlike the VCDPA, where enforcement is limited to the Attorney General, Virginia's breach notification statute allows a private right of action for direct economic damages resulting from a breach notification violation. Courts have entertained individual and class action lawsuits under this provision.

The Attorney General can impose civil penalties of up to $150,000 per breach or series of similar breaches discovered during a single investigation.

Enforcement and Penalties

The Virginia Attorney General has exclusive enforcement authority over the VCDPA. There is no private right of action, meaning individual consumers cannot file lawsuits against businesses for VCDPA violations.

The enforcement process works as follows:

1. The Attorney General identifies a potential violation and sends written notice identifying the specific provisions at issue
2. The business has 30 days to cure the alleged violation
3. If the business cures the violation and provides a written statement that it will not engage in further violations, the Attorney General takes no action
4. If the business fails to cure, the Attorney General can bring a civil action with penalties of up to $7,500 per violation
5. The Attorney General can also recover reasonable investigation expenses, including attorney fees

The 30-day cure period is permanent under the VCDPA. Unlike privacy laws in some other states that have removed or plan to remove their cure periods, Virginia's cure provision remains in effect.

As of early 2026, the Virginia Attorney General's office has focused enforcement activity on the VCDPA's newer provisions, including social media restrictions for minors that took effect January 1, 2026. Attorney General Jay Jones announced in February 2026 that his office intends to fully enforce these provisions.

Consumers can file complaints about potential VCDPA violations with the Virginia Attorney General's Office.

Recent and Pending Legislation

Virginia's biometric privacy landscape continues to develop:

2025 VCDPA amendments. The VCDPA's sensitive-data definition, Va. Code 59.1-575, does not include a reproductive or sexual health category. The one substantive 2025 change to the VCDPA was the addition of the social media protections for minors at Va. Code 59.1-577.1, covered below.

2026 social media provisions. SB 854, signed into law on May 2, 2025, added requirements for social media platforms to use commercially reasonable methods to determine whether users are minors under 16 and to limit minors' use to one hour per day unless a parent consents to increase the limit. These provisions took effect January 1, 2026.

2026 student-athlete biometric protections. Va. Code 23.1-408.2, added by 2026 Va. Acts c. 247, created consent requirements for the disclosure of college student-athletes' biometric data and for name, image, and likeness contracts that would condition a deal on possession of that data. It is a dedicated biometric statute sitting outside the VCDPA framework, though it reaches only the student-athlete context.

Facial recognition sunset. Effective July 1, 2026, the detailed authorized-use frameworks that had governed local law enforcement (Va. Code 15.2-1723.2) and campus police (Va. Code 23.1-815.1) expired. The current text of both sections instead bars a local or campus police department from purchasing or deploying facial recognition technology at all unless expressly authorized by statute; the NIST 98-percent-accuracy, model-policy, and annual-reporting requirements that applied before July 1, 2026 no longer appear in either section. Va. Code 52-4.5 (State Police) carried the identical sunset clause from the same 2022 act, but unlike sections 15.2-1723.2 and 23.1-815.1, the official Code of Virginia site has not posted any post-sunset version of section 52-4.5. Its status should be treated as unresolved, not as continuing under the pre-sunset framework.

Employer biometric data. Virginia has not enacted an employer-specific biometric data law. HB 1215, which would have established requirements for employer capture and destruction of biometric data with penalties up to $25,000 per violation and a private right of action, was left in committee during the 2021 session and has not been reintroduced.

How Virginia Compares to Other States

Virginia's approach to biometric privacy falls in the middle of the spectrum among U.S. states:

Stronger than states with no protections. Many states still lack any specific biometric data protections. Virginia's classification of biometric data as sensitive data requiring consent, combined with its facial recognition restrictions on government, puts it ahead of states that have no privacy framework in place.

Weaker than dedicated biometric privacy laws. States like Illinois, Texas, and Washington have general biometric privacy statutes with specific requirements for notice, consent, retention schedules, and data destruction that apply across the economy. Virginia's two standalone provisions are far narrower, reaching only fingerprints taken for a business transaction and the biometric data of college student-athletes. Illinois's BIPA also includes a private right of action that has produced significant litigation and settlements exceeding $1 billion.

Similar to other comprehensive privacy law states. Virginia's approach closely mirrors states like Connecticut, Colorado, and Kentucky, which all classify biometric data as sensitive data within their comprehensive consumer privacy frameworks and require opt-in consent for processing.

Sources and References

This article references Virginia statutes and official state government publications. For the full text of the VCDPA, visit the Virginia Legislative Information System. For guidance on consumer rights and filing complaints, visit the Virginia Attorney General's Office.

This article provides general legal information about Virginia biometric privacy laws. It is not legal advice. Consult a qualified attorney for guidance on your specific situation. Laws and regulations change frequently. Verify current requirements through official Virginia government sources.

More Virginia Laws

• Virginia Deepfake Laws
• Virginia Employee Monitoring Laws
• Virginia GPS Tracking Laws
• Virginia Recording Laws

Frequently Asked Questions

Does Virginia have a standalone biometric privacy law like Illinois?

Not a general one. Virginia has no BIPA-style consumer biometric statute. The Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023, classifies biometric data as sensitive data within its comprehensive consumer privacy framework and requires opt-in consent before processing it for identification, but it does not include the detailed retention schedules, destruction timelines, or private right of action found in Illinois BIPA. Two narrower provisions do sit outside the VCDPA: Va. Code 59.1-478 requires fingerprints furnished in conjunction with a business, commercial or financial transaction to be returned or destroyed within twenty-one days of the transaction's completion or termination unless the parties agree otherwise, and Va. Code 23.1-408.2 protects the biometric data of college student-athletes.

Can I sue a company in Virginia for collecting my fingerprints without consent?

Not under the VCDPA. The Virginia Attorney General has exclusive enforcement authority, and the law explicitly states it does not provide a basis for a private right of action. If you believe a company collected your biometric data without consent, you can file a complaint with the Virginia Attorney General's Office. The AG can investigate and pursue civil penalties of up to $7,500 per violation. However, Virginia's breach notification law (Va. Code 18.2-186.6) does preserve an individual's right to recover direct economic damages if a breach notification violation occurs.

Does the VCDPA protect my biometric data at work?

No. The VCDPA exempts personal data collected in an employment context. If your employer collects fingerprints for timekeeping, uses facial recognition for building access, or requires biometric scans, the VCDPA does not regulate that activity, and Virginia has not enacted a comprehensive law governing employer use of biometric data. One separate provision may still matter: Va. Code 59.1-478 requires fingerprints furnished in conjunction with a business, commercial or financial transaction to be returned or destroyed within twenty-one days of the transaction's completion or termination unless the parties agree otherwise, and it applies regardless of an employer's size. It is written around transactions rather than employment, however, and no Virginia appellate decision applies it to workplace fingerprinting. A bill (HB 1215) that would have created employer biometric data protections was left in committee in 2021 and has not been reintroduced.

What biometric data does the VCDPA cover?

The VCDPA covers data generated by automatic measurements of biological characteristics used to identify a specific individual. This includes fingerprints, voiceprints, eye retinas, irises, and other unique biological patterns. Photographs, video recordings, audio recordings, and data generated from those recordings are not covered. Data collected for health care treatment, payment, or operations under HIPAA is also excluded from the definition.

How does Virginia regulate facial recognition technology?

Virginia regulates facial recognition through separate statutes that apply to government agencies, not private businesses. Local law enforcement (Va. Code 15.2-1723.2) and campus police (Va. Code 23.1-815.1) may not purchase or deploy facial recognition technology unless a separate statute expressly authorizes it; that ban took effect July 1, 2026, when the state's 2022 regulated-use framework expired under its own sunset clause. Va. Code 52-4.5 gave the State Police the same kind of NIST-accuracy-based authority and carried the identical sunset clause, but the official Code of Virginia site has not posted a post-sunset version of that section, so the State Police's current status is unresolved rather than confirmed as continuing.