The Virginia Consumer Data Protection Act (VCDPA), codified at Va. Code § 59.1-575 et seq., came into effect on January 1, 2023. It establishes clear rights for state consumers and specific obligations for businesses that process personal data of those individuals.

If your website serves users from Virginia, this guide explains what changes for you.

The VCDPA is Virginia's state-level personal data protection law. It follows the logic of the major modern privacy regulations around the world: giving people back control over their own data.

If you are already familiar with the LGPD, the GDPR, or the California CCPA, the VCDPA framework will feel familiar. The law is organized around three pillars: consumer rights, controller obligations, and enforcement by the Attorney General.

Enforcement is the exclusive responsibility of the Virginia Attorney General. There is no private right of action for consumers.

On January 1, 2023.

Virginia was a pioneer among US states, passing the law in 2021 and giving businesses nearly two years to comply. That does not mean enforcement is lenient, only that the runway was generous.

Under Va. Code § 59.1-576, the law applies to persons that conduct business in Virginia or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least 100,000 consumers, or

Control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.

The focus is not on where the business is headquartered. It is on who the users are. If your site has Virginia traffic at scale, the law may reach you regardless of where your business operates.

Understanding the difference between controller and processor is the first step in defining which role your business plays in the processing relationship.

Under Va. Code § 59.1-576 B, the following are exempt:

State and local government bodies and their political subdivisions.

Financial institutions regulated by the Gramm-Leach-Bliley Act (Title V).

Covered entities and business associates regulated by HIPAA.

Nonprofit organizations.

Institutions of higher education.

Also exempt are specific categories of data, including protected health information under HIPAA, data regulated by FERPA, consumer credit information regulated by the FCRA, and employee and job applicant data when used in that capacity.

Under Va. Code § 59.1-575, personal data is any information linked or reasonably linkable to an identified or identifiable natural person. This includes name, email address, IP address, browsing history, location data, device identifiers, and any information that allows a person to be tracked.

De-identified data and publicly available information are excluded.

A thorough data mapping exercise reveals where this data is being generated and processed in your digital environment.

Under Va. Code § 59.1-575, sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.

Genetic or biometric data processed to uniquely identify an individual.

Personal data collected from known children (under 13 years of age).

Precise geolocation data (within a radius of 1,750 feet).

Sensitive data cannot be processed without the consumer's explicit consent, under Va. Code § 59.1-578 A, 5.

Starting January 1, 2026, the VCDPA includes a specific section for operators of social media platforms (Va. Code § 59.1-577.1).

"Minor," for purposes of this section, is any person under 16 years of age (not 13, but 16).

Social media platform operators must:

Use commercially reasonable methods, such as a neutral age screen mechanism, to determine whether a user is a minor.

Limit minors' use to 1 hour per day per service or application.

Allow parents or legal guardians to give verifiable parental consent to increase or decrease the daily time limit.

Use data collected for age determination solely for that purpose, without applying it to other processing operations.

This is one of the most concrete protections for teenagers among US state privacy laws, with direct impact on platforms such as social networks, entertainment apps, and any service that enables social online interaction.

Under Va. Code § 59.1-577, the law guarantees Virginia residents five main rights:

Right to access and confirmation: knowing whether the business processes their data and obtaining a copy in an accessible format.

Right to correction: correcting inaccuracies in personal data, considering the nature of the data and the purposes of processing.

Right to deletion: requesting the deletion of data the consumer provided or that was obtained about them.

Right to portability: obtaining data in a portable and, where technically feasible, readily usable format, when processing is carried out by automated means.

Right to opt-out: refusing the processing of personal data for targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

The controller has 45 days to respond. The deadline can be extended by another 45 days when reasonably necessary, considering complexity and volume of requests, as long as the consumer is notified within the initial period with the justification (Va. Code § 59.1-577 B, 1).

Service is free up to twice per year per consumer. For requests that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or decline, but the burden of demonstrating the excessive nature lies with the business (Va. Code § 59.1-577 B, 3).

Under Va. Code § 59.1-577 C, the controller must establish a process for the consumer to appeal denial decisions. The process must be conspicuously available and similar to the original request submission mechanism.

The business has 60 days to respond to the appeal in writing, including the decision and the reasoning. If the appeal is denied, the consumer must be informed about how to contact the Attorney General to submit a complaint.

Under Va. Code § 59.1-575, consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement. It may include a written statement, including by electronic means, or any other unambiguous affirmative action.

The correct standard for cookies: non-essential technologies off by default, with the user choosing what to enable, not what to disable.

Under Va. Code § 59.1-578, the controller must:

Limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes.

Not process data for purposes incompatible with those disclosed, except with consumer consent.

Implement reasonable technical, administrative, and physical data security practices proportionate to the volume and nature of the data.

Not process data in violation of anti-discrimination laws. Not discriminate against consumers who exercise their rights.

Not process sensitive data without prior consent.

For known children: compliance with COPPA's verifiable parental consent requirements constitutes compliance with the VCDPA's parental consent obligations.

Provide a reasonably accessible, clear, and meaningful privacy notice covering all elements required by law.

Establish at least one secure and reliable means for consumers to submit rights requests, without requiring the creation of a new account.

Conduct and document Data Protection Assessments for high-risk activities.

Cookies that collect personal data or allow user identification fall directly within the scope of the VCDPA.

Before firing any non-essential cookie, the site must display a clear cookie notice, obtain affirmative consent, block trackers until acceptance, and offer real opt-out options.

Correct tag categorization is what makes it possible to identify which cookies are necessary and which require consent.

If the site uses advertising pixels or any targeted advertising tool (Va. Code § 59.1-575 defines targeted advertising as ads based on consumer activities across non-affiliated websites over time), the law requires clear and conspicuous disclosure of this practice, along with an accessible opt-out mechanism (Va. Code § 59.1-578 D).

Under Va. Code § 59.1-580, the controller must conduct and document Data Protection Assessments for:

Processing personal data for targeted advertising.

Sale of personal data.

Processing for profiling where there is a reasonably foreseeable risk of harm to consumers.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Since 2024, the assessment requirement has been expanded to include online services directed at children (Va. Code § 59.1-580 B).

Assessments are confidential and exempt from public disclosure. The Attorney General may request access via civil investigative demand, and disclosure in response to such a request does not constitute waiver of attorney-client privilege.

Under Va. Code § 59.1-584, the Virginia Attorney General has exclusive authority to enforce the VCDPA. There is no private right of action.

Before initiating any action, the Attorney General must send written notice identifying the specific violations and granting 30 days to cure. If the controller cures the violation within the period and provides a written statement that the violations have been cured and will not recur, no action is initiated.

If the violation continues after the cure period or the controller breaches the written statement provided, the Attorney General may seek:

Injunctive relief to stop the violations.

Civil penalties of up to US$ 7,500 per violation.

Recovery of reasonable investigation and case preparation expenses, including attorney fees.

Understand what you collect, where it lives, how it is used, and with whom it is shared. Data mapping is the foundation of any compliance program.

The document must cover all five required information categories under Va. Code § 59.1-578 C.

A cookie banner that blocks non-essential trackers before acceptance, records consent, and offers real control options.

At least one secure and reliable mechanism to receive requests. No new account creation required.

For each high-risk activity, conduct and document the assessment as required by Va. Code § 59.1-580.

The 30-day cure period is guaranteed by law, but it is not a compliance strategy. Having processes structured from the start is what makes correction within the deadline viable.

Applying privacy by design from product conception is what makes compliance sustainable over time.

AdOpt records every consent interaction, blocks trackers before acceptance, and generates the auditable log you would need to present in an Attorney General investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory required for the privacy notice and the Data Protection Assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the VCDPA? Talk to our team.

To understand how these privacy laws compare in terms of structure and practical impact, our comparative guide goes deeper on the subject.

Compliance with the VCDPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the VCDPA and when did it come into effect?
The Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) is Virginia's state-level personal data protection law. It came into effect on January 1, 2023. It establishes rights for consumers residing in the state and compliance obligations for businesses that process the personal data of those individuals.

2. Who needs to comply with the VCDPA?
Businesses that conduct operations in Virginia or produce products and services targeted to its residents, and that control or process personal data of at least 100,000 consumers per year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data (Va. Code § 59.1-576 A).

3. What is the penalty for non-compliance?
The Attorney General may seek civil penalties of up to US$ 7,500 per violation, plus recovery of investigation costs and attorney fees. Before initiating any action, written notice with a 30-day cure period is mandatory. There is no private right of action (Va. Code § 59.1-584).

4. How long does a business have to respond to a consumer request?
45 days from receipt of an authenticated request. The deadline can be extended by another 45 days when reasonably necessary, with notification within the initial period. Service is free up to twice per year per consumer. For appeals, 60 days (Va. Code § 59.1-577 B and C).

5. What are the consumer rights under the VCDPA?
Consumers have five rights: access and confirmation, correction, deletion, portability, and opt-out of processing for targeted advertising, data sale, and profiling with legal or similarly significant effects. They also have the right to appeal any denial decision by the controller (Va. Code § 59.1-577).

Ready to bring your website into compliance with the VCDPA? Talk to our team.