Personal Information Privacy Act (merchant sale of purchaser information, check DOB, driver's license scanning)
VA PIPA
Other · Marketing
An older retail privacy law. Merchants must give notice (a sign is enough) before selling purchaser information gathered in a sale and must honor a customer's request not to sell it; they cannot sell information gathered only from check, card, or ID-number payment records. It also bars requiring a date of birth to accept a check and limits when merchants may scan, keep, or sell data from a driver's license barcode.
- Where
- Virginia
- Citation
- Va. Code §§ 59.1-442 to 59.1-444 (Title 59.1, Chapter 35), excluding § 59.1-443.2 (listed separately)
- Status
- In force
- In force since
- 1992-07-01
- Last amended
- 2020-07-01
- Enforced by
- Aggrieved persons in general district court (59.1-444)
- People can sue
- Yes
- Penalties
- $100 per violation plus reasonable attorney fees and costs to a prevailing plaintiff (59.1-444).
- Applies to
- Merchants selling goods from a fixed retail location in Virginia (59.1-442(B))
- Any person accepting checks for business (59.1-443.1)
What a privacy notice must say
- Give notice (for example, a posted sign) before selling purchaser information gathered in a retail sale to third persons, and do not sell it if the purchaser asks you not to.Va. Code § 59.1-442(A)
Practices it requires
- Do not sell information gathered solely from a customer's payment by check or credit card or from recording the customer's driver's license number.Va. Code § 59.1-442(A)
- Do not record or require a date of birth as a condition of accepting a check (year of birth may be requested).Va. Code § 59.1-443.1(B)-(C)
- Scan a driver's license or DMV ID machine-readable zone only for listed purposes (identity or authenticity checks for non-cash payments, returns, age verification, fraud prevention, legal compliance, FCRA or GLBA transactions).Va. Code § 59.1-443.3(A)
- Retain scanned license data only for permitted purposes and destroy it when the purpose is satisfied; never sell or share it for marketing.Va. Code § 59.1-443.3(B)-(C)
Sources
- Official text
- Va. Code Title 59.1, Chapter 35, Personal Information Privacy Act (law.lis.virginia.gov)
- Va. Code § 59.1-442 (Virginia Law, law.lis.virginia.gov)
- Va. Code § 59.1-443.1 (Virginia Law, law.lis.virginia.gov)
- Va. Code § 59.1-443.3 (Virginia Law, law.lis.virginia.gov)
- Va. Code § 59.1-444 (Virginia Law, law.lis.virginia.gov)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective dates inferred from Virginia's default July 1 effective date for regular-session acts; enacting bill pages not checked. History: 1992, c. 807; amended through 2020, cc. 542, 1227, 1246.
Research reference, not legal advice.