Committee tables bill to require data portability and optional social-media interoperability

Senator Van Vulenberg introduced Senate Bill 85 and a substitute, saying the proposal would give users the ability to download and transfer social-media and related AI data and would provide a framework for interoperability while expressly not forcing platforms to import other operators' data.

“The bill basically does two things,” the sponsor told the committee: portability for users, and a structure for interoperability. He said the substitute tightens security and privacy protections and delays the effective date to give companies time to comply.

Supporters told the committee portability could break platform lock‑in and spur competition. Matthew Lipka of Project Liberty said platforms that commercialize personal data make users the product and that the ability to export social connections and AI histories would let new platforms compete on features and privacy. “We need to reshape social media so you can exit platforms that aren’t serving you,” Lipka said.

Family advocates framed portability as a child‑safety measure. Deb Schmill of the Becca Schmill Foundation described the harms her daughter suffered after being targeted through social media and urged lawmakers to create incentives for platforms to be safer.

Industry witnesses and trade groups pressed the committee on feasibility and legal exposure. Melissa Aselen of the 51 Group (representing TechNet) said the substitute still contains provisions that could be unworkable for member companies. Eric Link of the Northern Virginia Technology Council warned that tying penalties to the Consumer Data Protection Act could expose operators to “$7,500 per incident,” a liability that could be difficult to manage at scale. Nathan Trail of the Information Technology Industry association told members the draft risks sharing third‑party data without consent and could present constitutional and preemption concerns.

Committee members pressed the patron on format standards, proprietary data protections and whether Utah’s earlier law and related federal proposals provided useful models. The sponsor pointed to language in the substitute (noted in committee as lines around 268–275) that clarifies platforms are not required to accept imported data and said Utah’s delayed rollout informed Virginia’s timing.

Members also applied a three‑part screening test used by the committee: fiscal impact, conflict with the Commonwealth’s Consumer Data Protection Act, and whether the bill appears on a watch list that could jeopardize federal funding. Committee discussion noted the bill may fall on a list of measures that threaten the Commonwealth’s ability to receive roughly $800 million in federal 'bead' funding if left unresolved.

Given the outstanding technical and legal questions, Delegate Shin moved to “gently lay this piece of legislation on the table” and request a letter to Jay Cotts for further examination. The motion passed 17–3, tabling SB85 for additional study.

What happens next: The committee requested a review by staff with a letter to Jay Cotts; proponents and industry groups will likely continue negotiations over definitions, security obligations and compliance pathways before any future reconsideration.