Overview of Virginia ID scanning laws
Virginia has 4 laws which we consider relevant to ID verification, in addition to other laws which may related to age verification, identity verification, KYC, privacy, and biometrics.
Can you scan IDs in Virginia?
Virginia law regulates a business’s practice of scanning IDs and retaining information obtained from a scan. Virginia prohibits merchants from scanning IDs unless they are:
- Verifying the authenticity of the ID or to verify the identity of the individual if the individual (a) pays for goods or services with a method other than cash, (b) returns an item, or (c) requests a refund or exchange
- Verifying the individual’s age in providing age-restricted goods or services
- Preventing fraud or other criminal activity if the individual returns an item or requests an exchange and the merchant uses a fraud prevention service company or system
- Information collected under this exception must be limited to name, address, date of birth, and ID number
- Complying with laws.
- Providing information to a check services company for purposes of administering or enforcing a transaction or preventing fraud or other criminal activity.
- Completing a transaction authorized under the Gramm-Leach-Bliley Act (applicable to financial services) or the Fair Credit Reporting Act.
Can you save data from a scanned ID in Virginia?
Scanned ID data can only be saved in Virginia if it meets the above criteria.
Does Virginia offer affirmative defense for ID scanning?
No. Virginia has no affirmative defense laws related to ID scanning.
What types of IDs does Virginia issue?
Virginia issues drivers licenses and state IDs, including REAL ID.
Individual Virginia ID verification laws
Age verification for alcohol sales
Virginia requires that businesses verify age but does not require electronic scanning or verification for alcohol sales.
Age verification for tobacco sales
Virginia requires that businesses verify age but does not require electronic scanning or verification for tobacco or vape sales.
ID scanning for scrap yards
Scrap metal dealers in Virginia are required to keep records, including the seller’s name and date of birth.
Age verification for pornography
Virginia requires age verification for websites that contain “a substantial portion of material that may be harmful to minors” to ensure visitors are at least 18.
Data privacy laws in Virginia
The Virginia Consumer Data Protection Act (VCDPA) requires businesses to:
- Provide consumers with a clear privacy notice that includes a way for consumers to opt-out of targeted advertising
- Comply with certain consumer requests (such as providing access to their personal data) within 45 days
- Obtain opt-in consent for sensitive data processing
- Disclose to consumers if their data will be sold
- Allow consumers to opt out of having their data sold
- Allow consumers to delete their data
