Virginia Attorney General Jay Jones released a 100-day progress report outlining his office's actions, including a pledge to enforce new Virginia Consumer Data Protection Act provisions requiring social media platforms to limit minor users to one hour of daily usage without parental consent, and a data privacy awareness campaign for Virginians. No specific privacy enforcement actions against private entities were detailed in the release.
In-house legal teams should review all vendor, customer, and partner agreements involving the collection or processing of data from minors in Virginia to ensure compliance with VCDPA requirements for parental consent and minor usage limits. Specifically, audit data processing clauses for provisions governing minor users, including parental opt-in mechanisms for social media usage exceeding one hour per day. Update privacy policies, breach notification clauses, and data retention policies to align with Virginia's children data protection rules, and verify that any social media platform vendors have implemented required minor usage restrictions and parental consent workflows.
Entity
Industry
Other"new provisions of the Virginia Consumer Data Protection Act"
"require social media platforms to limit minors’ usage to one hour per day unless a parent opts to increase that limit."
Virginia Attorney General Jay Jones joined a bipartisan coalition of 44 state attorneys general in submitting a comment letter supporting a proposed U.S. Department of Labor rule to increase transparency requirements for pharmacy benefit managers (PBMs) servicing employer-funded ERISA health plans. The coalition urged the DOL to clarify that the proposed rule does not preempt existing state PBM transparency laws and to coordinate enforcement with state attorneys general. This action is a policy advocacy comment letter and does not constitute an enforcement action against any specific entity.
A coalition of 21 attorneys general and the Governor of Pennsylvania filed lawsuits against the U.S. Department of Transportation, FMCSA, DHS, and AAMVA to prevent the federal government from obtaining a database of personal information of 17 million commercial driver's license holders. The lawsuits allege the federal government violated federal privacy laws and the Administrative Procedure Act by demanding the data without notice or guardrails, and threatening to withhold $10 million in federal funding if AAMVA refused.
Attorney General Jay Jones announced the creation of the Regulated Products Enforcement Unit to centralize civil enforcement for liquid nicotine products, THC and hemp-derived products, kratom, and related intoxicants. The unit will oversee compliance, directory administration, and public education. It will coordinate with Virginia ABC and other agencies to take legal action against violators.
Attorney General Jay Jones joined a coalition of 26 states to sue the Trump administration over unlawful conditions attached to counterterrorism and emergency funding. The conditions would require states to share voter data with DHS and assist in immigration enforcement, which the coalition argues violates the Administrative Procedure Act and the Spending Clause.
$18.0M
Virginia Attorney General Jay Jones joined a coalition of 42 state attorneys general in a multistate settlement with 23andMe over a 2023 data breach that exposed the genetic data of approximately 6.9 million customers. The settlement requires 23andMe to pay $18 million to the states and $46.75 million to affected consumers, resolving allegations of inadequate security practices and delayed breach notification.
Virginia Attorney General Jay Jones joined a bipartisan coalition of 13 attorneys general alleging that Nexstar and Tegna are violating a court's hold-separate order by allowing Nexstar personnel to remain on Tegna's Board of Directors during the merger litigation. The coalition seeks clarification of the order to ensure the companies operate independently while the antitrust case proceeds.