Virginia Consumer Data Protection Act (VCDPA) (Virginia)
Virginia has enacted the Virginia Consumer Data Protection Act (VCDPA) (Virginia). The law is currently in effect. It applies to controls or processes personal data of >=100,000 consumers or >=25,000 consumers and derives >50% of gross revenue from sale of personal data. Consumers have the right to delete their data, correct inaccurate data, opt out of data sales. Violations can result in penalties of up to $7,500 per violation.
Important Notes
No private right of action. AG enforces with 30-day cure period. Penalty up to $7,500 per violation. Appeal response 60 days.
Privacy Compliance Tools — Partner Services
Need help achieving Virginia compliance? These tools help businesses manage consent, honor consumer requests, and maintain audit-ready records.
Sponsored. DataTactic may earn a referral fee from these partners. This does not affect our data or editorial content.
What is the Virginia and who does it apply to?
The Virginia Consumer Data Protection Act (VCDPA) (Virginia) is Virginia's comprehensive consumer privacy law, effective 2023-01-01. Controls or processes personal data of >=100,000 consumers OR >=25,000 consumers AND derives >50% of gross revenue from sale of personal data
What rights do Virginia consumers have under Virginia?
Under the Virginia, Virginia consumers have the right to: access their personal data, request deletion of their data, correct inaccurate data, obtain a portable copy of their data, opt out of the sale of their personal data, opt out of targeted advertising, opt out of profiling for significant decisions, appeal a denial of their privacy rights request.
Does Virginia require consent for sensitive data?
Yes. The Virginia requires businesses to obtain affirmative consent before processing sensitive personal data. This includes data such as health information, biometric data, precise geolocation, and other sensitive categories.
What are the penalties for violating Virginia?
Violations of the Virginia can result in civil penalties of up to $7,500 per violation and up to $7,500 per willful violation. There is no private right of action — enforcement is exclusively by the state Attorney General.
Does Virginia require a data protection assessment?
Yes. The Virginia requires businesses to conduct data protection assessments for high-risk processing activities such as targeted advertising, sale of personal data, sensitive data processing, and certain profiling activities.
Is there a universal opt-out requirement under Virginia?
The Virginia does not currently require recognition of universal opt-out mechanisms. Businesses are not required to honor browser-based opt-out signals.
How long does a business have to respond to a consumer request under Virginia?
Businesses must respond to consumer privacy requests within 45 days under the Virginia. An extension of up to 45 additional days is available with notice to the consumer. If a request is denied, businesses must provide an appeals process with a response within 60 days.
Official Source
Virginia Attorney General
More Virginia Resources
Data Methodology
DataTactic researchers verify privacy law data directly against official government sources — Virginia Attorney General publications, state statutes, and agency websites. Each data point is cross-referenced against primary sources before publication. Records are reviewed and updated when laws or requirements change.
Last verified: 2026-06-01 · DataTactic provides reference information only. This is not legal advice. Consult a qualified attorney for compliance guidance.