Consumer Protection, Data Privacy, and AI: Five New Rules for Customer-Facing Businesses

Jun 22, 2026

Virginia’s 2026 General Assembly enacted a cluster of consumer-facing changes that affect any business interacting with the public. Five of them deserve close attention.

Why it matters: Penalties under the Virginia Consumer Protection Act and related statutes may require operational adjustments — not just policy updates — by July 1.

1. Gift card theft, forgery, and fraud (HB 662/SB 444)

Why retailers should care: Gift card draining schemes — where fraudsters tamper with cards on display, capture the activation codes, and drain the value once a consumer purchases the card — have been a growing problem. Codified criminal offenses give law enforcement clearer authority to investigate and prosecute, and give retailers stronger ground when documenting and reporting incidents.

What to do: Review your gift card display security. Train staff on what to look for during sales. Document incidents promptly when they occur.

2. Sale of precise geolocation data prohibited (SB 338)

Amends the Virginia Consumer Data Protection Act: data controllers may not sell or offer for sale precise geolocation data — defined as data identifying a consumer’s location within a radius of 1,750 feet.

Who is affected: Any business operating in Virginia that processes consumer location data through apps, loyalty programs, or web properties — and that has historically derived revenue from sharing or selling that data.

What to do: Review your data practices. If your business or any service provider you use monetizes geolocation data, this revenue stream is closed in Virginia. Update privacy policies to reflect the change.

3. Unauthorized use of voice or likeness (HB 581/SB 753)

Expands existing protections for unauthorized commercial use of a person’s name, portrait, or picture to cover voice or likeness — including AI-generated content. Punitive damages and statute of limitations protections apply.

Why it matters now: Generative AI tools make voice cloning and likeness generation easy. Marketing teams using AI to produce creative content need to know that synthesized voices or likenesses of identifiable people — including celebrities, public figures, and customers or employees — require consent.

What to do: Update your marketing approval workflows. Any AI-generated content that could be construed as someone’s voice or likeness needs documented authorization.

4. Auto-renewal shipping disclosures (SB 184)

Suppliers shipping goods to Virginia consumers under an auto-renewal or continuous service offer must include a shipping invoice stating:

  • The amount the consumer was charged for shipping, if any
  • Information on how to return the goods, if returns are accepted
  • Information on how to cancel the auto-renewal or continuous service offer

An exemption applies if the supplier already provides this information by timely electronic confirmation or otherwise makes it readily available to the consumer.

What to do: If your business operates any subscription, recurring shipment, or continuous service offer, audit your fulfillment process. Either include the required information on every shipping invoice, or ensure the electronic confirmation path is documented and reliable.

5. Penny rounding procedures (HB 954)

Localities are authorized to set temporary procedures for adjusting bills and tax balances in cash transactions, given the U.S. Mint’s cessation of penny production. The authorization runs through July 1, 2027, and the Department of Taxation will recommend a uniform statewide procedure by November 1, 2026.

Why this matters now: Cash-handling businesses need to know how to handle penny rounding starting July 1. Watch for guidance from your locality and from the Department of Taxation.

What to do: If your business handles cash, decide on your rounding approach (typically rounding to the nearest five cents). Train cashiers. Update POS configurations where applicable.

Two specialized callouts

  • Cosmetics retailers and manufacturers (HB 122): Specific ingredients are prohibited in cosmetic products manufactured, sold, or distributed in Virginia. Existing inventory before July 1, 2026 is grandfathered. Retailers who do not manufacture or knowingly sell prohibited products are exempt.
  • Plant-based food sellers (HB 322/SB 186): Manufactured-protein food products that purport to be meat or poultry must include a conspicuous qualifying term on the label in close proximity to the meat term. Civil penalty up to $500 per violation. This is also a Virginia Consumer Protection Act violation.

What’s next: Thursday we go deep on the restaurant and ABC changes — including the long-awaited reform of the 45 percent food-to-beverage ratio.

The bottom line: None of these five changes require massive operational overhauls. But each requires at least one process or policy update by July 1. Walk through them with your team this week.

This communication is provided for general informational purposes only and does not constitute legal advice. Statutory citations and effective dates reflect the bills as enacted by the 2026 Virginia General Assembly. Member businesses should consult qualified legal counsel for guidance on specific compliance obligations applicable to their circumstances.