                                 CODE OF VIRGINIA

(EFFECTIVE JANUARY 1, 2026) DEFINITIONS (§ 59.1-575)

As used in this chapter, unless the context requires a different
meaning:		&#8220;Affiliate&#8221; means a legal entity that controls, is
controlled by, or is under common control with another legal entity or shares
common branding with another legal entity. For the purposes of this definition,
&#8220;control&#8221; or &#8220;controlled&#8221; means (i) ownership of, or the
power to vote, more than 50 percent of the outstanding shares of any class of
voting security of a company; (ii) control in any manner over the election of a
majority of the directors or of individuals exercising similar functions; or
(iii) the power to exercise controlling influence over the management of a
company.		&#8220;Authenticate&#8221; means verifying through reasonable means
that the consumer, entitled to exercise his consumer rights in § 59.1-577, is
the same consumer exercising such consumer rights with respect to the personal
data at issue.		&#8220;Biometric data&#8221; means data generated by automatic
measurements of an individual&#8217;s biological characteristics, such as a
fingerprint, voiceprint, eye retinas, irises, or other unique biological
patterns or characteristics that is used to identify a specific individual.
&#8220;Biometric data&#8221; does not include a physical or digital photograph,
a video or audio recording or data generated therefrom, or information
collected, used, or stored for health care treatment, payment, or operations
under HIPAA.		&#8220;Business associate&#8221; means the same meaning as the
term established by HIPAA.		&#8220;Child&#8221; means any natural person younger
than 13 years of age.		&#8220;Consent&#8221; means a clear affirmative act
signifying a consumer&#8217;s freely given, specific, informed, and unambiguous
agreement to process personal data relating to the consumer. Consent may include
a written statement, including a statement written by electronic means, or any
other unambiguous affirmative action.		&#8220;Consumer&#8221; means a natural
person who is a resident of the Commonwealth acting only in an individual or
household context. It does not include a natural person acting in a commercial
or employment context.		&#8220;Controller&#8221; means the natural or legal
person that, alone or jointly with others, determines the purpose and means of
processing personal data.		&#8220;Covered entity&#8221; means the same as the
term is established by HIPAA.		&#8220;Decisions that produce legal or similarly
significant effects concerning a consumer&#8221; means a decision made by the
controller that results in the provision or denial by the controller of
financial and lending services, housing, insurance, education enrollment,
criminal justice, employment opportunities, health care services, or access to
basic necessities, such as food and water.		&#8220;De-identified data&#8221;
means data that cannot reasonably be linked to an identified or identifiable
natural person, or a device linked to such person. A controller that possesses
&#8220;de-identified data&#8221; shall comply with the requirements of
subsection A of § 59.1-581.		&#8220;Health record&#8221; means the same as that
term is defined in § 32.1-127.1:03.		&#8220;Health care provider&#8221; means
the same as that term is defined in § 32.1-276.3.		&#8220;HIPAA&#8221; means
the federal Health Insurance Portability and Accountability Act of 1996 (42
U.S.C. § 1320d et seq.).		&#8220;Identified or identifiable natural
person&#8221; means a person who can be readily identified, directly or
indirectly.		&#8220;Institution of higher education&#8221; means a public
institution and private institution of higher education, as those terms are
defined in § 23.1-100.		&#8220;Nonprofit organization&#8221; means any
corporation organized under the Virginia Nonstock Corporation Act (§ 13.1-801
et seq.) or any organization exempt from taxation under § 501(c)(3), 501(c)(6),
or 501(c)(12) of the Internal Revenue Code, any political organization, any
organization exempt from taxation under § 501(c)(4) of the Internal Revenue
Code that is identified in § 52-41, and any subsidiary or affiliate of entities
organized pursuant to Chapter 9.1 (§ 56-231.15 et seq.) of Title
56.		&#8220;Online service, product, or feature&#8221; means any service,
product, or feature that is provided online. &#8220;Online service, product, or
feature&#8221; does not include telecommunications service, as defined in 47
U.S.C. § 153, broadband Internet access service, as defined in 47 C.F.R. §
54.400, or delivery or use of a physical product.		&#8220;Parent&#8221; means a
parent or legal guardian of a child or minor.		&#8220;Personal data&#8221; means
any information that is linked or reasonably linkable to an identified or
identifiable natural person. &#8220;Personal data&#8221; does not include
de-identified data or publicly available information.		&#8220;Political
organization&#8221; means a party, committee, association, fund, or other
organization, whether or not incorporated, organized and operated primarily for
the purpose of influencing or attempting to influence the selection, nomination,
election, or appointment of any individual to any federal, state, or local
public office or office in a political organization or the election of a
presidential/vice-presidential elector, whether or not such individual or
elector is selected, nominated, elected, or appointed.		&#8220;Precise
geolocation data&#8221; means information derived from technology, including but
not limited to global positioning system level latitude and longitude
coordinates or other mechanisms, that directly identifies the specific location
of a natural person with precision and accuracy within a radius of 1,750 feet.
&#8220;Precise geolocation data&#8221; does not include the content of
communications or any data generated by or connected to advanced utility
metering infrastructure systems or equipment for use by a
utility.		&#8220;Process&#8221; or &#8220;processing&#8221; means any operation
or set of operations performed, whether by manual or automated means, on
personal data or on sets of personal data, such as the collection, use, storage,
disclosure, analysis, deletion, or modification of personal
data.		&#8220;Processor&#8221; means a natural or legal entity that processes
personal data on behalf of a controller.		&#8220;Profiling&#8221; means any form
of automated processing performed on personal data to evaluate, analyze, or
predict personal aspects related to an identified or identifiable natural
person&#8217;s economic situation, health, personal preferences, interests,
reliability, behavior, location, or movements.		&#8220;Protected health
information&#8221; means the same as the term is established by
HIPAA.		&#8220;Pseudonymous data&#8221; means personal data that cannot be
attributed to a specific natural person without the use of additional
information, provided that such additional information is kept separately and is
subject to appropriate technical and organizational measures to ensure that the
personal data is not attributed to an identified or identifiable natural
person.		&#8220;Publicly available information&#8221; means information that is
lawfully made available through federal, state, or local government records, or
information that a business has a reasonable basis to believe is lawfully made
available to the general public through widely distributed media, by the
consumer, or by a person to whom the consumer has disclosed the information,
unless the consumer has restricted the information to a specific
audience.		&#8220;Sale of personal data&#8221; means the exchange of personal
data for monetary consideration by the controller to a third party. &#8220;Sale
of personal data&#8221; does not include:

1. The disclosure of personal data to a processor that processes the personal
data on behalf of the controller;

2. The disclosure of personal data to a third party for purposes of providing a
product or service requested by the consumer;

3. The disclosure or transfer of personal data to an affiliate of the
controller;

4. The disclosure of information that the consumer (i) intentionally made
available to the general public via a channel of mass media and (ii) did not
restrict to a specific audience; or

5. The disclosure or transfer of personal data to a third party as an asset that
is part of a merger, acquisition, bankruptcy, or other transaction in which the
third party assumes control of all or part of the controller&#8217;s assets.
			&#8220;Sensitive data&#8221; means a category of personal data that includes:

1. Personal data revealing racial or ethnic origin, religious beliefs, mental or
physical health diagnosis, sexual orientation, or citizenship or immigration
status;

2. The processing of genetic or biometric data for the purpose of uniquely
identifying a natural person;

3. The personal data collected from a known child; or

4. Precise geolocation data.
			&#8220;Social media platform&#8221; means a public or semipublic
Internet-based service or application that has users in the Commonwealth and
that meets the following criteria:

1. Connects users in order to allow users to interact socially with each other
within such service or application. No service or application that exclusively
provides email or direct messaging services shall be considered to meet this
criterion on the basis of that function alone; and

2. Allows users to do all of the following:
			a. Construct a public or semipublic profile for purposes of signing into and
using such service or application;			b. Populate a public list of other users
with whom such user shares a social connection within such service or
application; and			c. Create or post content viewable by other users, including
content on message boards, in chat rooms, or through a landing page or main feed
that presents the user with content generated by other users. No service or
application that consists primarily of news, sports, entertainment, ecommerce,
or content preselected by the provider and not generated by users, and for which
any chat, comments, or interactive functionality is incidental to, directly
related to, or dependent on the provision of such content, or that is for
interactive gaming, shall be considered to meet this criterion on the basis of
that function alone.			&#8220;State agency&#8221; means the same as that term is
defined in &#xA7; 2.2-307.			&#8220;Targeted advertising&#8221; means displaying
advertisements to a consumer where the advertisement is selected based on
personal data obtained from that consumer&#8217;s activities over time and
across nonaffiliated websites or online applications to predict such
consumer&#8217;s preferences or interests. &#8220;Targeted advertising&#8221;
does not include:

1. Advertisements based on activities within a controller&#8217;s own websites
or online applications;

2. Advertisements based on the context of a consumer&#8217;s current search
query, visit to a website, or online application;

3. Advertisements directed to a consumer in response to the consumer&#8217;s
request for information or feedback; or

4. Processing personal data processed solely for measuring or reporting
advertising performance, reach, or frequency.
			&#8220;Third party&#8221; means a natural or legal person, public authority,
agency, or body other than the consumer, controller, processor, or an affiliate
of the processor or the controller.			&#8220;User&#8221; means a person not
acting as an agent of a controller or processor.

HISTORY: 2021, Sp. Sess. I, cc. 35, 36; 2022, cc. 451, 452; 2024, cc. 840, 844;
2025, c. 703.