79%
of Virginia's 19 requirements are already met by California (CA). Here is what VCDPA adds, biggest gaps first.
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
VCDPA adds2 Opt-in consent to process sensitive data; since July 1, 2026, selling precise geolocation data is prohibited outright.
Va. Code § 59.1-578(A)(5)-(6) · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
VCDPA adds2 Internal appeal answered within 60 days; on denial, controller must give a way to complain to the Attorney General.
Va. Code § 59.1-577(C) · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
VCDPA adds1 Businesses controlling or processing data of 100,000+ Virginia consumers a year, or 25,000+ consumers while deriving over 50% of gross revenue from data sales.
Va. Code § 59.1-576(A) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
VCDPA adds3 Public commitment, reasonable measures and contracts for deidentified data; pseudonymous data exempt from core rights if kept separate; oversight duty.
Va. Code § 59.1-581 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means VCDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
