The Virginia age verification law requires any commercial website where more than one-third of the content is harmful to minors to confirm that every visitor is at least 18 before showing restricted material. Codified at Virginia Code § 8.01-40.5 and effective July 1, 2023, the statute sets the verification methods operators may use, forbids them from keeping the identifying data afterward, and lets parents sue noncompliant sites for damages and attorney fees.1Virginia General Assembly. SB1515 – 2023 Session Bill Tracking
Which Websites Are Covered
The law reaches commercial entities that knowingly publish or distribute material harmful to minors online, but only when a “substantial portion” of the site’s total content qualifies. Virginia sets that line at more than 33⅓ percent, matching Louisiana, Mississippi, and Utah.2Congress.gov. Online Age Verification (Part I): Current Context A dedicated adult site clears the threshold. A general social platform that permits some adult content but is not built around it does not.
“Commercial” narrows the scope further. The statute targets businesses that profit from making this material available, not individual users posting content and not nonprofits. And because the threshold measures total content rather than traffic or revenue, an operator cannot dilute an adult catalog by bolting on a large volume of unrelated material.3Virginia General Assembly. Senate Bill 1515
What Counts as Harmful to Minors
Virginia uses the three-part obscenity framework the U.S. Supreme Court established in 1973. Content qualifies only when it appeals to a sexual interest judged by contemporary community standards, depicts sexual conduct in a patently offensive way, and lacks serious literary, artistic, political, or scientific value for minors. All three must be present.
That test carves out a lot. A medical illustration, a news photograph, or a literary novel containing sexual passages does not qualify, because each carries recognized value. In practice the definition captures dedicated pornography sites, not platforms hosting art, journalism, or health education.
How Operators Must Verify Age
Before restricted content becomes visible, a covered site must verify each visitor’s age. The statute allows two routes: a commercially available database that businesses or government agencies regularly use for age and identity verification, or any other “commercially reasonable” method of confirming age and identity.3Virginia General Assembly. Senate Bill 1515
Most compliant sites contract with a third-party verification vendor. The vendor cross-references a scanned government-issued ID or driver’s license against public records, confirms the person is 18 or older, and returns a pass-or-fail result to the website. The operator never handles the raw ID. What the statute does not accept is self-declaration. An age checkbox, a birthdate entry field, or a click-through confirmation is not verification.
Facial Age Estimation
A newer method uses AI-powered facial analysis to estimate whether a user meets the age threshold, often without a document upload. The system analyzes facial features in real time, returns an estimate, and discards the image. Because it creates less friction for users, it is gaining ground as an alternative to ID scanning. Whether it counts as “commercially reasonable” under Virginia’s statute has not been tested in court.
Data Privacy Rules
Once the check confirms the visitor is 18 or older, neither the site nor any third-party verification service may retain the personal identifying information used in that check.3Virginia General Assembly. Senate Bill 1515 The data must be purged. No copies, no logs, no backup files.
The law also forbids using anything collected during verification for purposes beyond the age check. Marketing profiles, data sales, and cross-site tracking built on that information are all off-limits. Requiring people to hand over government IDs to reach legal content creates an obvious privacy risk, and the no-retention rule is the statute’s answer to it.
If a breach occurs during the brief window when data is in transit or being processed, Virginia’s general breach notification statute applies. Any entity that owns or licenses computerized personal information must notify the Office of the Attorney General and every affected Virginia resident without unreasonable delay after discovering unauthorized access, when the exposed data pairs a name with a driver’s license number, Social Security number, financial account number, or passport number.4Virginia Code Commission. Virginia Code 18.2-186.6 – Breach of Personal Information Notification
Penalties for Noncompliance
Enforcement runs through private civil lawsuits, not government prosecution. A commercial entity that violates the statute is liable for damages resulting from a minor gaining access to harmful material, plus reasonable attorney fees and court costs.3Virginia General Assembly. Senate Bill 1515 Parents or legal guardians of a minor who accessed unverified content are the ones who can bring the claim.
Financial exposure scales with the number of families that sue. The statute puts no cap on damages, so a high-traffic site operating without an age gate could face claims from many households at once, each carrying an attorney-fee award on top of whatever damages the court sets. What the statute does not include is a per-violation fine imposed by the Attorney General. Some states built government enforcement with fixed penalty amounts into their versions of this law; Virginia chose to rely entirely on private litigation.
What Virginia Users Actually See
Rather than build or license verification systems, several major adult websites blocked Virginia visitors outright. Pornhub disabled access for Virginia IP addresses before the July 1, 2023 effective date, and an analysis of the 65 largest adult tube sites found that at least 10 blocked Virginia users in the weeks after the law took effect. For operators, the cost of implementing state-by-state verification often exceeds the advertising revenue those states produce, and blocking is the cheaper option.
The blocking approach has an obvious workaround. A virtual private network routes traffic through a server in another state or country, making the visitor appear to be outside Virginia. The statute does not exempt VPN traffic, but detecting and filtering it is difficult for site operators, and this is arguably the law’s largest enforcement gap.
Constitutional Status After the 2025 Supreme Court Ruling
The adult entertainment industry challenged a nearly identical Texas statute, arguing that age verification should face strict scrutiny, the most demanding constitutional standard. In Free Speech Coalition, Inc. v. Paxton, decided June 27, 2025, the U.S. Supreme Court disagreed in a 6–3 decision authored by Justice Thomas.5Supreme Court of the United States. Free Speech Coalition, Inc. v. Paxton, No. 23-1122 Because age verification only incidentally burdens adults’ access to protected speech, the Court held that intermediate scrutiny applies, and the Texas law easily met that standard. A direct challenge to Virginia’s statute is still possible, but the ruling gives the Virginia law a strong constitutional footing.
The Separate Social Media Law
The age verification statute for adult content is different from Virginia’s social media rules. Senate Bill 854, signed in 2025 and effective January 1, 2026, requires social media platforms to use commercially reasonable methods to determine whether a user is younger than 16, and to limit an identified minor’s use to one hour per day per service unless a parent gives verifiable consent to change the limit.6Virginia General Assembly. SB854 – 2025 Regular Session It applies to all social platforms regardless of content, targets users under 16 rather than under 18, and imposes time limits rather than an access block. If your question is about a general-audience social platform, that is the law to look at, not § 8.01-40.5.