VCDPA: Virginia Consumer Data Protection Act
Virginia consumer privacy law granting access, deletion, correction, and opt-out rights for targeted advertising, sale, and profiling, with controller/processor obligations modeled on the GDPR.
VCDPA citations (6)
Definitions
Defines key terms for the Virginia Consumer Data Protection Act (VCDPA), including consumer, controller, processor, personal data, sensitive data, consent, and sale of personal data. Under VCDPA, a consumer must be a Virginia resident acting in an individual or household context.
Scope; exemptions
Establishes applicability thresholds for businesses targeting Virginia residents, requiring compliance for entities processing data of 100,000+ consumers, or 25,000+ consumers if over 50% of gross revenue comes from selling personal data. Provides exemptions for government entities, HIPAA-covered entities, GLBA financial institutions, and nonprofits.
Personal data rights; consumers
Grants Virginia consumers key rights, including confirming processing and accessing data, correcting inaccuracies, deleting personal data, obtaining a portable copy of data, and opting out of targeted advertising, sale of personal data, and profiling.
Data controller responsibilities; transparency
Requires data controllers to practice data minimization, implement reasonable data security, and obtain opt-in consent for sensitive data. Since July 1, 2026, SB 338 (2026 Acts of Assembly ch. 820) also bars a controller from selling or offering for sale a consumer's precise geolocation data, and consent does not lift that ban. Mandates a clear and accessible privacy notice disclosing categories of data processed, processing purposes, sharing with third parties, and instructions for exercising rights.
Data protection assessments
Requires controllers to conduct and document data protection assessments for high-risk activities, including processing for targeted advertising, selling personal data, processing sensitive data, and profiling that poses a foreseeable risk of harm. Assessments must weigh processing benefits against consumer risks.
Enforcement; civil penalty; expenses
Vests exclusive enforcement authority in the Virginia Attorney General and denies a private right of action for consumers. Requires a 30-day notice and cure period before initiating actions, and allows civil penalties of up to $7,500 per violation and recovery of reasonable investigative expenses.
Legal notice: This reference library is for informational purposes only and does not constitute legal advice. Excerpts are reproduced from official public sources and are current as of July 2026. Laws and regulations change: always verify against the authoritative source and consult a qualified attorney.