1. A. As used in this section:

   "Biometric data" means an individual's physiological, biological, or behavioral characteristics that are used or intended to be used alone or in combination with other identifying data to establish such individual's identity. "Biometric data" includes information pertaining to an individual's deoxyribonucleic acid (DNA); imagery of the iris, retina, fingerprint, face, hand, palm, and vein patterns and voice recordings from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted; keystroke patterns or rhythms; gait patterns or rhythms; and sleep, health, or exercise data that contain identifying information.

   "Institution" means the same as that term is defined in § 23.1-408.1.

   "Student-athlete" means the same as that term is defined in § 23.1-408.1.

2. B. No institution shall disclose to any individual or entity outside of the institution any enrolled student-athlete's biometric data without the prior written consent of the student-athlete.
3. C. No individual or entity shall make the possession, use, or ownership of or the rights to any student-athlete's biometric data a condition of any contract with the student-athlete for the use of the student-athlete's name, image, or likeness without the prior written consent of the student-athlete in a writing that is separate and apart from such contract.

2026, c. 247.