HB 654 Virginia House of Delegates · 2026 Regular Session

Consumer Data Protection Act; definition of "biometric data"; consent required for processing.

Summary

Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data. Provides that, under the Consumer Data Protection Act, no consumer, controller, processor, or affiliate of the controller or processor shall process biometric data, defined separately in the bill, concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act.

Issues: ✓ Technology

Bill status in committee 1 of 4 stages cleared

Introduction

Jan 2026

Committee Review

Floor Vote

Governor

Introduced Jan 13, 2026 Last action Feb 18, 2026

Maddy AI version diff · 1 comparison

What changed between versions

Introduced → Communications, Technology and Innovation Substitute · 5 edits

MODERATE

The bill was amended from its original introduction to a substitute version by the House Committee on Communications, Technology and Innovation. The primary changes narrow the scope of biometric data protection to focus specifically on facial data, eye retinas, and irises rather than all biometric data. The definition was also refined to remove references to neural data and HIPAA-related data, while adding specific language about facial mapping and geometry technologies.

Scope change

The bill's scope was narrowed from covering all biometric data to specifically covering facial data, eye retinas, and irises. The definition of biometric data was replaced with a more specific definition of facial data, and neural data was removed from the scope entirely.

DEFINITION

The broad definition of 'biometric data' was replaced with a specific definition of 'facial data' that focuses on facial mapping, facial geometry, and facial template technologies.

References to neural data and data related to HIPAA health care treatment, payment, or operations were removed from the biometric data definition.

REQUIREMENT

New subsection C was added to exempt air carriers from the requirements and to address federal preemption for national security and health care matters.

The consent requirement was modified to specifically mention 'facial data or data related to eye retinas or irises' rather than all biometric data.

ELIGIBILITY

The reference to 'controller, processor, or affiliate' was changed to only 'controller, processor, or affiliate' in the context of facial data, and the term 'consumer' was added to clarify who the protections apply to.

Floor votes

How they voted

No floor votes recorded yet.

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Feb 18, 2026

Lower · Passed

Left in Committee Communications, Technology and Innovation

lower

Feb 4, 2026

Lower · Passed

Subcommittee recommends laying on the table (7-Y 3-N)

lower

Feb 4, 2026

Lower · Passed

House subcommittee offered

lower

Jan 26, 2026

Committee

Assigned HST sub: Technology and Innovation

lower

Jan 13, 2026

Committee

Referred to Committee on Communications, Technology and Innovation

lower

1 primary · 9 co-sponsors