AI Laws in Arlington, Virginia
AI Laws USA tracks 38 AI rules that apply to people and businesses in Arlington, Virginia: 10+ federal rules, 26 Virginia state-level rules, and 2 local Arlington/county ordinances. Coverage is strongest on government use of AI, data-center siting and energy, consumer protection, and automated decision-making. 23 of these rules are already in effect. Each entry below links to its official source.
Arlington local AI rules (and Arlington County)
2 local AI rules specific to Arlington, Virginia or Arlington County.
-
In effect Strength: limited
Arlington VA Public Schools
Arlington, VA · Effective October 24, 2024 · Arlington VA Public Schools — Guidance on AI Use in APS (2024-10-24)
Districtwide guidance authorizes vetted enterprise tools (Microsoft Copilot, Google Gemini for Education), bars student PII entry into consumer AI, requires teacher disclosure to families when AI is used in instructional design, and prohibits AI as sole basis for grading or discipline.
-
In effect Strength: moderate
Arlington County VA ACPD Automated License Plate Reader
Arlington County, VA · Effective April 1, 2024 · ACPD General Order 605 (ALPR policy) (2024-04-01)
Arlington County Police Department adopted formal ALPR governance policy with 30-day data retention limit, restricted access, audit trails, and required reasonable-suspicion or investigative purpose for queries; aligns with Virginia Code §15.2-1723.1.
Virginia-level AI rules most relevant to Arlington
26 Virginia state rules apply to residents and businesses in Arlington. Showing the 8 most relevant to Arlington's local picture; 18 more are on the Virginia jurisdiction page.
-
In effect Strength: limited
Virginia VCDPA (opt out of profiling, $7,500/violation)
Virginia · Effective January 1, 2023 · Va. Code 59.1-575 to 59.1-585 (esp. 59.1-577, 59.1-580, 59.1-584); HB 2307 / SB 1392 (2021)
Virginia's comprehensive privacy law gives consumers the right to opt out of 'profiling' used to make decisions producing legal or similarly significant effects, such as automated decisions affecting credit, housing, employment, or essential services. Businesses must obtain heightened consent before processing the data of a known child (via federal COPPA) and must conduct documented data protection assessments for higher-risk processing, including certain profiling. The Attorney General enforces the law and may seek up to $7,500 per violation; there is no private right of action.
-
In effect Strength: moderate
Virginia EO 22 (2026) — data center accountability + AI task force
Virginia · Effective September 18, 2026 · Va. Exec. Order No. 22 (Sept. 18, 2026)
Virginia's governor signed an executive order on September 18, 2026 that does two separate things: it starts implementing a new Virginia Data Center Accountability Framework, and it creates a rapid-response AI Task Force. Most of the data center half is instruction — agencies are told to study, draft, consult and report back within 120, 180 and 240 days. TWO provisions bite immediately. First, no executive branch agency may enter into, enforce, or require a nondisclosure agreement that keeps the public from learning material information about a proposed commercial data center, its public incentives, its expected resource demands, or its community impacts; existing NDAs are honored, but new ones (absent extraordinary circumstances such as national security) violate the order. Second, effective on issuance, the Virginia Economic Development Partnership may no longer give a new data center project with anticipated peak demand of 25 MW or more any assistance through the Virginia Business Ready Sites Program, any expedited permitting program, or any similar discretionary state site-readiness or expedited-review program. The order also DESIGNATES the Eastern Virginia Groundwater Management Area a cooling water scarcity area and tells DEQ to expedite rules for noise and for cooling water scarcity. READ THE PRESS COVERAGE CAREFULLY: national and local outlets reported that Virginia was 'eliminating by-right approval' and 'requiring local approval of any data center using more than 25 megawatts.' Those are items in the framework the governor will ask the 2027 General Assembly to pass. THEY ARE NOT IN THIS ORDER. A governor cannot rewrite local land use law by executive order, and this one does not try to. What the order's own 25 MW threshold governs is eligibility for STATE economic-development assistance, not local approval.
-
In effect Strength: moderate
Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026)
Virginia · Effective July 1, 2026 · Va. Code § 15.2-1723.2 (2026), effective July 1, 2026
Virginia Code § 15.2-1723.2, effective July 1, 2026, imposes statewide binding requirements on how local law enforcement agencies in Virginia may use facial recognition technology. Agencies wishing to use facial recognition must publicly post a policy meeting or exceeding the State Police model, publish annual use reports by April 1 each year, and give 30 days written notice to their governing body before procuring the technology. The law bans real-time tracking of identified individuals in public spaces and prohibits creating a live-video database using facial recognition. All searches must be logged and violations by operators constitute a Class 3 misdemeanor. The law applies to all Virginia localities, including Northern Virginia regional law enforcement systems.
-
In effect Strength: moderate
VA PDD Act (2017 — first)
Virginia · Effective July 1, 2017 · Va. Code §§ 46.2-100, 46.2-908.1:1
Virginia was the first U.S. state to legalize sidewalk delivery robots. PDDs may operate on sidewalks and crosswalks (10 mph cap, 50 lb cargo limit), must carry $100,000 liability insurance and a visible operator ID, and localities may further regulate them. Starship Technologies' deployment at George Mason in 2019 traces back to this law.
-
In effect Strength: limited
Va. Code 19.2-11.14 (humans, not AI, must decide bail/sentencing/parole)
Virginia · Effective July 1, 2025 · Va. Code 19.2-11.14; HB 1642 (2025), Va. Acts c. 637
Virginia requires that key criminal-justice decisions be made by a human being, even when an AI tool produces a recommendation or prediction. The rule covers pretrial detention or release, prosecution, adjudication, sentencing, probation, parole, correctional supervision, and rehabilitation. No such decision may be made without a human decision-maker, and any AI-generated recommendation is subject to any challenge or objection allowed by law.
-
In effect Strength: moderate
VA SCC Data Center Rate Case
VA · Effective November 13, 2024 · Va. SCC Case No. PUR-2024-00144
Virginia's State Corporation Commission opened a formal investigation into how data center load growth — driven by AI compute demand — should be allocated across electricity rate classes, to keep residential customers from subsidizing AI data centers. Includes minimum-billing demands and special tariffs.
-
In effect Strength: moderate
Virginia SCC data center transmission cost order (2026)
Virginia · Effective July 15, 2026 · Va. State Corp. Comm'n, Dominion Energy Va. Rider T-1 proceeding (2026)
The Virginia State Corporation Commission ordered Dominion Energy to develop a policy directly assigning the cost of transmission infrastructure to data centers and other large-load customers that connect to it — with the stated goal of an acceptable and symmetrical approach to assigning costs in those circumstances. The order came out of Dominion's proposed change to Rider T-1, the line item recovering transmission investment, which the utility wanted increased to recover roughly $1.5 billion. The numbers make the effect legible: under Dominion's original filing a residential customer using 1,000 kilowatt-hours would have paid about $2.90 more per month. Under the new allocation methodology that falls to about $0.94. The Piedmont Environmental Council described it as a first step toward requiring large-load data centers to pay for transmission facilities built solely to serve them. Virginia had already established a separate rate class for large data centers by regulatory action in 2025, and the 2026 General Assembly passed SB 253 and HB 1393 requiring that large load customers have no adverse effect on other customers' rates. This order is the SCC applying that principle to transmission specifically, in the state with by far the largest data center concentration in the country.
-
In effect Strength: moderate
Virginia § 15.2-2209.5 data center siting disclosure law (2026)
Virginia · Effective July 1, 2026 · Va. Code § 15.2-2209.5 (2026), enacted by HB 153 and SB 94, effective July 1, 2026
Virginia now has a statewide law governing where the largest data centers may go and what their developers must disclose before a local board votes. It took effect July 1, 2026 as Va. Code § 15.2-2209.5, enacted through identical companion bills HB 153 and SB 94. What it does is narrower than the debate around it suggests, and the distinction matters. The law REQUIRES STUDIES. It forces a developer to study NOISE, and it forces the utility to disclose SUBSTATIONS, before the local vote happens. It does NOT set a noise limit. It does NOT set a water cap. It does NOT set a setback. In the Roanoke Rambler's framing, understanding that difference is what separates holding a project accountable from misreading what local officials are actually empowered to do. This is a DISCLOSURE-AND-PROCESS statute, not a substantive-standards statute — it changes what a board must know before it votes, not what it may approve. That is a real but bounded protection, and it sits directly on a gap this dataset records again and again: local decibel ordinances that specify a dBA figure with no measurement methodology behind it. A mandatory noise study supplies the evidence that such limits presuppose, which is worth something even where no limit exists. The political history is the other reason to record this. Both patrons represent Prince William County, the heart of Northern Virginia's data center buildout, where fights over noise, substations and water produced the legislation. A BROADER version passed in 2025 — HB 1601 and SB 1449 — and Gov. Glenn Youngkin declined to sign it, returned it with amendments, and vetoed it on May 2, 2025, citing concerns about reduced local autonomy. Gov. Abigail Spanberger signed the 2026 version, which her office lists among the new laws taking effect July 1 and describes as bipartisan. More than 60 data center bills were introduced in Virginia in 2026; about 15 passed, many as identical House and Senate pairs.
Federal AI rules that apply in Arlington, Virginia
These federal rules apply everywhere in the United States, including Arlington, Virginia. Showing the 10 strongest and most recent.
-
In effect Strength: stronger
TVA data center capacity commitment charge (2026)
Tennessee Valley Authority · Effective October 1, 2026 · Tenn. Valley Auth. Bd. of Dirs. — Data Center Capacity Commitment Charge (approved Aug. 20, 2026; eff. Oct. 1, 2026)
The Tennessee Valley Authority's Board of Directors approved a separate, higher wholesale rate for data centers on August 20, 2026, effective October 1. New or expanding data center loads above 5 megawatts now fall under a Capacity Commitment Charge attached to TVA's data center rate schedules, designed to recover the incremental capacity costs those customers impose on the system. The headline figures are substantial: upfront capacity commitment charges of roughly $1.5 million per megawatt, payable over three to five years, and an all-in average billing increase for data center customers of about 10%, phased in across three consecutive fiscal years. The stated purpose is to keep residential rates low while still serving growing data center demand. TVA matters here out of proportion to a single utility. It is a federal corporate agency supplying power across seven states, so this is not a state rate case but a regional cost-allocation decision reaching a large share of the Southeast — and TVA is among the first large US utilities to adopt a tariff aimed specifically at AI-driven load. Where most 2026 measures in this dataset restrict where data centers may be built, this one changes what they pay to run.
-
In effect Strength: stronger
Bartz v. Anthropic
N.D. Cal. · Effective September 5, 2025 · Bartz v. Anthropic PBC, No. 3:24-cv-05417 (N.D. Cal.)
Authors Andrea Bartz, Charles Graeber, and Kirk Wallace Johnson sued Anthropic over its use of pirated-book datasets to train Claude. In June 2025 Judge William Alsup ruled that training on lawfully purchased books was fair use. The piracy claims (LibGen ingestion) proceeded toward settlement; in September 2025 Anthropic agreed to a $1.5 billion class settlement covering ~500,000 works. Judge Alsup granted preliminary approval September 25, 2025 and final approval July 20, 2026. The appeal period runs through August 19, 2026; class members will not receive payments until at least end of 2026.
-
In effect Strength: stronger
COPPA + 2025 Rule (childrens data)
United States · Effective June 23, 2025 · 15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312
COPPA requires online services aimed at children under 13 to get verifiable parental consent before collecting kids' personal data. The 2025 rule update — fully in effect since April 22, 2026 — adds biometric identifiers (like face templates and voiceprints, which matter for AI tools), requires separate parental consent before sharing children's data for targeted advertising, and tightens data retention limits.
-
In effect Strength: stronger
TAKE IT DOWN Act
United States · Effective May 19, 2025 · Pub. L. No. 119-12 (S. 146)
Makes it a federal crime to knowingly publish intimate images of someone without consent, including AI-generated deepfakes. Social media and similar platforms must give victims a way to request removal and must take the content (and known copies) down within 48 hours. The platform removal requirement became enforceable May 19, 2026, and the FTC has already begun enforcement.
-
Blocked / in litigation
NetChoice v. Yost (Ohio)
S.D. Ohio · Effective April 16, 2025 · NetChoice, LLC v. Yost, No. 2:24-cv-00047 (S.D. Ohio Apr. 16, 2025)
Ohio's Social Media Parental Notification Act — requiring parental consent for minors' social-media use, including algorithmic feeds — was preliminarily enjoined on February 12, 2024, then permanently enjoined on April 16, 2025 when the district court granted summary judgment for NetChoice. The state appealed to the Sixth Circuit, which vacated the district court's injunction in 2026.
-
In effect Strength: stronger
Thaler v. Perlmutter (Copyright)
D.C. Cir. · Effective March 18, 2025 · Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025)
The companion copyright case: Stephen Thaler sought to register a copyright with 'Creativity Machine' (his AI) as the author. The D.C. Circuit affirmed in March 2025 that the Copyright Act's human-authorship requirement is dispositive as a matter of statutory law. AI cannot be a copyright author under U.S. law.
-
In effect Strength: stronger
Louis v. SafeRent
D. Mass. · Effective November 20, 2024 · Louis v. SafeRent Solutions, LLC, No. 1:22-cv-10800 (D. Mass.)
SafeRent agreed in November 2024 to a $2.275M settlement and a five-year ban on using its 'SafeRent Score' for housing-voucher applicants, after a class action alleged its AI tenant-screening tool systematically denied housing to Black and Hispanic Section 8 voucher holders. The first major AI tenant-screening Fair Housing Act settlement.
-
In effect Strength: stronger
FTC Impersonation Rule (AI)
United States · Effective April 1, 2024 · 16 C.F.R. Part 461; 89 Fed. Reg. 15017
The FTC's Impersonation Rule lets the agency directly sue scammers who pretend to be a government agency or a real business — including those who use AI-cloned voices or generated images to do so. Civil penalties can reach $53,088 per violation. The FTC also issued a supplemental notice in February 2024 proposing to extend the rule to all individual impersonation.
-
In effect Strength: stronger
FTC v. Rite Aid
FTC · Effective February 26, 2024 · FTC v. Rite Aid Corp., No. 2:23-cv-05023 (E.D. Pa. Dec. 19, 2023)
The FTC banned Rite Aid from using facial-recognition technology in its stores for five years after finding the pharmacy chain's FRT system falsely tagged customers — disproportionately women and people of color — as shoplifters, leading to wrongful detentions and humiliations.
-
In effect Strength: stronger
TCPA (AI voice calls)
United States · Effective February 8, 2024 · 47 U.S.C. § 227; FCC 24-17
Robocalls using AI-cloned or AI-generated voices are treated like other 'artificial voice' calls: callers need your prior express consent, must identify themselves, and must offer opt-outs for telemarketing. You can personally sue violators for $500 to $1,500 per illegal call.
Frequently asked questions about AI laws in Arlington, Virginia
Are there AI laws in Arlington, Virginia?
What federal AI rules apply in Arlington?
Does Virginia have an AI privacy law?
Are deepfakes illegal in Virginia?
Can my employer use AI to screen me for jobs in Arlington?
How do I report an AI law violation in Arlington?
Are facial recognition cameras allowed in Arlington?
Is Arlington regulated by Virginia's consumer privacy act?
Have we missed an AI rule in Arlington?
This page is generated from our open civic dataset. If you know of a Arlington ordinance, county rule, or local enforcement action we should add, email feedback@ailawsusa.com or submit a correction. Every entry must include a verifiable source.