Regulations › US states › Virginia
VCDPA
Virginia Consumer Data Protection Act
WhenIn effect since 1 January 2023
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsBusinesses controlling or processing data of 100,000+ Virginia consumers a year, or 25,000+ co…
Universal opt-outNo requirement to honor universal opt-out signals
Cure periodPermanent 30-day cure period after written AG notice
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation, plus investigation costs and attorney fees
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
Businesses controlling or processing data of 100,000+ Virginia consumers a year, or 25,000+ consumers while deriving over 50% of gross revenue from data sales.Va. Code § 59.1-576(A) · source ↗
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and higher education.Va. Code § 59.1-576(B) · source ↗
Sensitive data and minors
Sensitive data
2
Opt-in consent to process sensitive data; since July 1, 2026, selling precise geolocation data is prohibited outright.Va. Code § 59.1-578(A)(5)-(6) · source ↗
Categories are standard; scored 2 for the geolocation sale ban (effective July 1, 2026 per AG summary), not broader categories.
Children and teens
2
Under 13: COPPA parental consent for targeted ads, sale or profiling; social media platforms must limit users under 16 to one hour daily absent parental consent.Va. Code §§ 59.1-578(F), 59.1-577.1 · source ↗
§ 59.1-577.1 enacted 2025, c. 703 (effective Jan. 1, 2026). Litigation status of the social media limit not checked this session.
Data minimization
1
Collection limited to what is adequate, relevant and reasonably necessary for disclosed purposes.Va. Code § 59.1-578(A)(1) · source ↗
Consumers' rights
Rights
2
Access, correct, delete, portability, and opt out of targeted advertising, sale and significant profiling.Va. Code § 59.1-577(A) · source ↗
Request deadline
2
45 days, extendable once by 45 days with notice.Va. Code § 59.1-577(B)(1) · source ↗
Appeals
2
Internal appeal answered within 60 days; on denial, controller must give a way to complain to the Attorney General.Va. Code § 59.1-577(C) · source ↗
Universal opt-out
0
No requirement to honor universal opt-out signals.Va. Code § 59.1-577 · source ↗
Neither the statute sections read nor the AG summary mention preference signals.
Business duties
Assessments
2
Assessments required for targeted ads, sale, risky profiling, sensitive data, heightened-risk processing and child-directed services; AG may demand them.Va. Code § 59.1-580(A), (B), (D) · source ↗
Processor contracts
3
Binding contract with instructions, confidentiality, deletion, compliance information, assessments or independent audit, and written subcontractor flow-down.Va. Code § 59.1-579(B) · source ↗
No subcontractor notice or objection right, unlike Colorado and Connecticut.
Privacy notice
1
Clear notice of categories, purposes, rights and appeals, data shared and third-party categories, plus conspicuous sale and targeted ad disclosure.Va. Code § 59.1-578(C)-(D) · source ↗
Loyalty programs
1
Different prices allowed for voluntary participation in bona fide loyalty, rewards, discount or club card programs.Va. Code § 59.1-578(A)(4) · source ↗
De-identified data
3
Public commitment, reasonable measures and contracts for deidentified data; pseudonymous data exempt from core rights if kept separate; oversight duty.Va. Code § 59.1-581 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority.Va. Code § 59.1-584(A) · source ↗
Maximum penalty
2
Up to $7,500 per violation, plus investigation costs and attorney fees.Va. Code § 59.1-584(C)-(D) · source ↗
Rulemaking
0
No rulemaking authority.Va. Code § 59.1-584 · source ↗
No rulemaking provision found in sections read.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws