Privacy Law Library

Virginia Consumer Data Protection Act

VCDPA

Comprehensive privacy · Children · Location · Health · Biometric · Genetic

Virginia's comprehensive consumer privacy law gives residents rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant-decision profiling, with an appeal process. Controllers need opt-in consent for sensitive data, must run data protection assessments for higher-risk processing, and face extra limits on known children's data (2025) and a ban on selling precise geolocation data (from July 1, 2026). Section 59.1-577.1 on minors' social media time limits is listed as a separate entry because it is enjoined.

Where
Virginia
Citation
Va. Code §§ 59.1-575 to 59.1-584 (Title 59.1, Chapter 53)
Status
In force
In force since
2023-01-01
Last amended
2026-07-01
Enforced by
Virginia Attorney General (exclusive authority, 59.1-584(A))
People can sue
No
Penalties
After a 30-day written notice and cure period, the Attorney General may seek an injunction and civil penalties of up to $7,500 per violation, plus investigation expenses and attorney fees (59.1-584(B)-(D)).
Applies to
  • Persons that conduct business in Virginia or produce products or services targeted to Virginia residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data (59.1-576(A))
  • Exempt entities: state and local government bodies, GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, and institutions of higher education (59.1-576(B))
  • Exempt data includes PHI, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data, and employment-context data (59.1-576(C))

What a privacy notice must say

  • Provide a reasonably accessible, clear privacy notice listing categories of data processed, purposes, how to exercise and appeal rights, categories shared, and categories of third parties; disclose sale and targeted advertising and how to opt out.Va. Code § 59.1-578(C)-(D)

Rights it gives people

  • Consumers may confirm processing and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects; a parent may act for a known child.Va. Code § 59.1-577(A)

Practices it requires

  • Respond to requests within 45 days (one 45-day extension with notice), free of charge up to twice a year; explain any refusal and how to appeal.Va. Code § 59.1-577(B)
  • Offer a conspicuous appeal process and answer appeals in writing within 60 days, telling the consumer how to complain to the Attorney General if denied.Va. Code § 59.1-577(C)
  • Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes; get consent for incompatible secondary uses.Va. Code § 59.1-578(A)(1)-(2)
  • Do not process sensitive data (including health diagnosis, genetic or biometric identifiers, known-child data, and precise geolocation) without consent; process known-child sensitive data per COPPA.Va. Code § 59.1-578(A)(5); 59.1-575
  • Do not sell or offer for sale a consumer's precise geolocation data (location within a 1,750-foot radius).Va. Code § 59.1-578(A)(6) · From 2026-07-01
  • Contract terms that waive or limit consumer rights are void; do not discriminate against consumers for exercising rights.Va. Code § 59.1-578(A)(4), (B)
  • Conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data, and other heightened-risk processing, and for online services directed to known children; produce them to the Attorney General on a civil investigative demand.Va. Code § 59.1-580(A)-(D)
  • Processor contracts must set processing instructions, confidentiality, deletion or return, audit cooperation, and subcontractor flow-down terms.Va. Code § 59.1-579
  • Without COPPA-compliant parental consent, do not process a known child's data for targeted advertising, sale, or significant-decision profiling, beyond what is needed, or longer than needed; limit and signal any collection of a known child's precise geolocation.Va. Code § 59.1-578(F) · From 2025-01-01

Security duties

  • Maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the data.Va. Code § 59.1-578(A)(3)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The 2022 amendments (c. 423 on deletion of third-party-sourced data; cc. 451, 452 repealing the Consumer Privacy Fund in 59.1-585) were read from the Code history notes, not from the bill pages; the companion 2021 bill (c. 35) was not separately checked.

Research reference, not legal advice.