Virginia Consumer Data Protection Act

Scope and territorial reach

Scope

The Virginia Consumer Data Protection Act (VCDPA, Va. Code §59.1-575 et seq.) was the second comprehensive US state privacy law, effective 1 January 2023. It applies to entities conducting business in Virginia or producing products/services targeted to Virginia residents that:

• Process the data of ≥100,000 Virginia consumers per year, OR
• Process the data of ≥25,000 consumers AND derive ≥50% of gross revenue from the sale of personal data.

“Sale” under VCDPA means exchange for monetary consideration only — narrower than CCPA which includes “other valuable consideration”.

Consent baseline

VCDPA uses an opt-out model — controllers may process personal data unless and until the consumer opts out for specific purposes:

• Sale of personal data
• Targeted advertising
• Profiling that produces legal or similarly significant effects

For sensitive data (race, religion, health, sexual orientation, citizenship status, genetic/biometric data, data from a known child, precise geolocation) — VCDPA requires opt-in consent.

Consumer rights

• Right to access — confirm whether their personal data is processed and obtain a copy
• Right to correct inaccurate personal data
• Right to delete personal data provided by or obtained about them
• Right to data portability — receive a copy in a portable, readily usable format
• Right to opt out of sale, targeted advertising, and profiling for significant decisions
• Right to appeal — controllers must provide an internal appeal process

Response timeline: 45 days, extendable by 45 days once for complex requests.

Universal opt-out signal

VCDPA does not mandate recognition of the Global Privacy Control (GPC) signal. This is a key contrast with California (CCPA) and Colorado (CPA) which do require it. Virginia’s approach treats GPC as one of multiple acceptable opt-out methods, not a mandatory one.

Data Protection Assessments (§59.1-580)

Required for: targeted advertising, sale of personal data, processing of sensitive data, profiling with significant risk, and other “high-risk” activities. Must weigh the benefits to the controller and consumer against the risks. Available to the Attorney General upon request.

Controller and processor obligations

• Privacy notice — categories of data, processing purposes, sale or sharing categories, consumer rights, and how to exercise them
• Data security — reasonable administrative, technical, physical safeguards
• Processor contracts — bind processors to assist with VCDPA obligations

Enforcement

Exclusive enforcement by the Virginia Attorney General — no private right of action. Pre-enforcement 30-day cure period for violations the AG identifies. Maximum civil penalty: $7,500 per violation.

The Virginia AG has taken a moderate enforcement stance through 2024-2026 — focused on warning letters and cure-period compliance rather than maximum penalties. No public final fines as of mid-2026.

How VCDPA compares to CCPA/CPRA

Key references

• Virginia Attorney General — Office of Consumer Protection
• Va. Code §59.1-575 through §59.1-585 (statute)
• Virginia Office of the Attorney General VCDPA implementation guidance

Seven principles (Article 5)

The constitutional backbone — every processing activity must satisfy all seven simultaneously.

1. 01
   Transparent privacy notice §59.1-578(C)

   Provide a reasonably accessible, clear privacy notice listing categories of data, processing purposes, sale/sharing, third-party categories, and rights-exercise mechanisms.

2. 02
   Purpose limitation §59.1-578(A)(1)

   Limit collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purposes.

3. 03
   Data minimization §59.1-578(A)(1)

   Do not process data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes without consumer consent.

4. 04
   Reasonable security §59.1-578(A)(3)

   Establish, implement, and maintain reasonable administrative, technical, and physical data-security practices appropriate to the volume and nature of data.

5. 05
   Non-discrimination §59.1-578(A)(4)

   Do not process personal data in violation of state/federal anti-discrimination laws and do not discriminate against consumers exercising VCDPA rights.

6. 06
   Sensitive data opt-in §59.1-578(A)(5)

   Obtain consumer consent before processing sensitive data — racial/ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, citizenship/immigration status, genetic/biometric data, precise geolocation, and personal data of a known child.

7. 07
   Data Protection Assessments §59.1-580

   Conduct and document DPAs for high-risk processing — targeted advertising, sale of data, certain profiling, sensitive-data processing, and any activity presenting heightened risk of harm.

8. 08
   Children's data §59.1-578(A)(5)(vii)

   Process personal data of a known child only in accordance with COPPA; for minors 13-15, opt-in consent is required for sale and targeted advertising.

Six lawful bases (Article 6)

You must identify and document one before processing — and consent isn't always the right one.

Eight data-subject rights (Articles 12–22)

What individuals can demand from you, with the response window and scope.

National addons

GDPR is a Regulation — directly applicable, no transposition required. But Member States layer additional rules on top via national acts.

Compared to other laws

Side-by-side rule comparison with the same field on each side.

Common questions