§ 59.1-584StatuteReference only

Enforcement

Effective January 1, 2023Reviewed July 2026

Reference only: This requirement is not currently tested by the Privisy scanner. It is included for reference. Consult a qualified attorney to assess your compliance posture.

What it requires

Vests exclusive enforcement authority in the Virginia Attorney General and denies a private right of action for consumers. Requires a 30-day notice and cure period before initiating actions, and allows civil penalties of up to $7,500 per violation and recovery of reasonable investigative expenses.

Legal text (excerpt)

The Attorney General shall have exclusive authority to enforce the provisions of this chapter. [...] Prior to initiating any action under this chapter, the Attorney General shall provide a controller or processor 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated.

Virginia Consumer Data Protection Act: § 59.1-584, Statute, effective 2023

Primary source

Virginia Office of the Attorney General: § 59.1-584: Enforcement

Legal notice: This page is for informational purposes only and does not constitute legal advice. The legal text excerpt is reproduced from official public sources and is current as of the stated effective date. Laws change: verify against the authoritative source and consult a licensed attorney for compliance guidance.

Stop Guessing. Start Knowing.

Find out exactly where your website stands before a regulator does.

Get My Compliance Audit