Restricted use of Social Security numbers
VA SSN protection
Data security
Bars businesses from publicly displaying Social Security numbers, printing them on access cards, requiring them as a sole website login, showing them on mailings, or embedding them in barcodes, chips, or magnetic strips. Internal verification and administrative uses remain allowed.
- Where
- Virginia
- Citation
- Va. Code § 59.1-443.2; enforcement via § 59.1-200(A)(43) (Virginia Consumer Protection Act)
- Status
- In force
- In force since
- 2005-07-01
- Last amended
- 2008-07-01
- Enforced by
- Virginia Attorney General and local attorneys under the Virginia Consumer Protection Act; consumers via VCPA private action (59.1-444, 59.1-200(A)(43), 59.1-204)
- People can sue
- Yes
- Penalties
- A violation is a VCPA prohibited practice: private action for actual damages or $500 (up to treble or $1,000 if willful) and civil penalties up to $2,500 per willful violation (59.1-204, 59.1-206).
- Applies to
- Any person other than a public body as defined in 2.2-3701 (59.1-443.2(D))
Security duties
- Do not intentionally communicate an individual's SSN to the general public.Va. Code § 59.1-443.2(A)(1)
- Do not print SSNs on cards needed to access products or services.Va. Code § 59.1-443.2(A)(2)
- Do not require an SSN to access a website unless a password, PIN, or other authentication device is also required.Va. Code § 59.1-443.2(A)(3)
- Do not mail anything on which an SSN is visible, inside or outside the envelope or package.Va. Code § 59.1-443.2(A)(4)
- Do not embed an SSN, encrypted or not, in a card or document through a barcode, chip, magnetic strip, or similar technology.Va. Code § 59.1-443.2(E)
Sources
- Official text
- Va. Code § 59.1-443.2 (Virginia Law, law.lis.virginia.gov)
- Va. Code § 59.1-444 (Virginia Law, law.lis.virginia.gov)
- Va. Code § 59.1-200 (Virginia Law, law.lis.virginia.gov)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective dates inferred from Virginia's default July 1 effective date for regular-session acts; enacting bill pages not checked. History: 2005, c. 640; 2008, cc. 562, 820.
Research reference, not legal advice.