AG Continues to Defend New Social Media Restrictions
State Senator Schuyler T. VanValkenburg shepherded amendments to the Virginia Consumer Data Protection Act through the General Assembly in early 2025. The bill, SB 854, passed the House and Senate unanimously in February 2025 and was approved by Governor Youngkin that May. [1]
SB 854 added a new provision to Chapter 53 of the Virginia Code, also known as the Virginia Consumer Data Protection Act (VCDPA): § 59.1-577.1. The VCDPA is a relatively lean statute, providing a list of rights pertaining to an individual’s personal data, as well as disclosure requirements and limitations on the scope of data processing. [2] The attorney general has exclusive authority to enforce the VCDPA—there is no private right of action. [3] The VCDPA empowers the AG to sue for an injunction, as well as recover reasonable costs and a $7,500 penalty per violation. [4]
Sen. VanValkenburg’s amendment added a new section to the VCDPA that imposed requirements upon social media companies’ treatment of minors (defined as below the age of 16). [5] Specifically, the amendment requires operators of social media platforms to use “commercially reasonable methods” to determine whether a user is a minor and limit the minor’s use of the platform to one hour per day, with parental controls to modify the time limit. [6] The new provision further prevents social media companies from changing the quality or price of their products because of the one-hour minor use limit. [7]
The bill bore an effective date of January 1, 2026, [8] which did not stop trade association NetChoice from filing suit in late 2025. [9] NetChoice’s mission, according to its website, is to “make the Internet safe for free enterprise and free expression.” [10] Helmed by Virginia resident Steve DelBianco, NetChoice files lawsuits all over the country challenging state regulations of internet providers. [11] The organization counts Amazon, Meta, OpenAI, Reddit, YouTube, Netflix, Airbnb, Google, Lyft, TikTok, X, JP Morgan Chase, and a litany of other major corporations among its members. [12]
The lawsuit, filed in the Eastern District of Virginia under Section 1983, alleges that the new VCDPA provision violates the First Amendment facially and as applied to NetChoice members, is unconstitutionally vague, and violates the dormant Commerce Clause. [13] NetChoice argues that the VCDPA provision burdens the First Amendment rights of both children and adults, because it subjects children to a default restriction only adjustable by their parents and further requires adults to prove their age when accessing social media. [14] The complaint also alleges First Amendment impediments upon its own members, contending that NetChoice’s members disseminate their own speech to their users. [15] Ultimately, NetChoice alleges that these various restrictions on children, parents, and its own members fail to survive strict or intermediate scrutiny. [16]
NetChoice’s unconstitutional vagueness claim is less voluminous and appears to be somewhat ancillary to the First Amendment claim, arguing simply that the VCDPA’s language leaves something to the imagination. NetChoice alleges that the definition of “user” is vague—must a user be an account holder? [17] The complaint further points out the ambiguity of the “one hour” restriction and critiques the vagueness of the requisite age verification mechanism. [18]
In its third count, NetChoice alleges violation of the dormant Commerce Clause, in light of the Internet’s need for “a cohesive national scheme of regulation.” [19] The jurisdictional statement of the VCDPA, which long predates the new provision, gives the attorney general jurisdiction over companies conducting business in Virginia or targeting Virginia residents that either control or process data for at least 100,000 consumers or control or process data for at least 25,000 consumers and derive more than 50% of their gross revenue from the sale of personal data. [20] To put it simply, the VCDPA easily gives the AG jurisdiction over NetChoice’s members.
NetChoice seeks injunctive and declaratory relief and has filed a motion for a preliminary injunction. [21] The storied boutique, Clement & Murphy, is among counsel of record. [22] The Commonwealth has, as expected, filed its brief opposing a preliminary injunction, as well as a motion to dismiss. [23] Last week, Attorney General Jay Jones released a statement reiterating his office’s opposition to the lawsuit and its intent to “fully enforce” the new VCDPA provision. [24] The district court has delayed its ruling on the motion to dismiss until it decides the motion for a preliminary injunction. [25]
https://lis.virginia.gov/bill-details/20251/SB854
Va. Code Title 59.1, Chapter 53
Va. Code § 59.1-584
Id.
Va. Code § 59.1-577.1
Id.
Id.
https://lis.virginia.gov/bill-details/20251/SB854
NetChoice v. Jason S. Miyares, Docket No. 1:25-cv-02067 (E.D. Va. Nov 17, 2025)
https://netchoice.org/about/#our-mission
https://netchoice.org/team/steve-delbianco/; https://netchoice.org/litigation/
https://netchoice.org/about/#association-members
NetChoice v. Jason S. Miyares, Docket No. 1:25-cv-02067 (E.D. Va. Nov 17, 2025), Complaint ¶ 92, 118, 126
Id. at ¶ 93-96
Id. at ¶ 97
Id. at ¶ 99-115
Id. at ¶ 119
Id. at ¶ 120
Id. at ¶ 125
Va. Code § 59.1-576
NetChoice v. Jason S. Miyares, Docket No. 1:25-cv-02067 (E.D. Va. Nov 17, 2025), Complaint, Prayer for Relief
Id. signature
Id. docket items no. 16, 40
https://www.oag.state.va.us/media-center/news-releases/2961-attorney-general-jay-jones-takes-steps-to-keep-virginias-children-safe-from-predatory-social-media-companies
NetChoice v. Jason S. Miyares, Docket No. 1:25-cv-02067 (E.D. Va. Nov 17, 2025), docket item no. 48
