Virginia Consumer Data Protection Act (VCDPA): An Overview

The United States does not yet have a federal privacy law, but led initially by California, more states are enacting their own data privacy laws.

Virginia was the second state to pass a privacy act from HB 2307 with the Virginia Consumer Data Protection Act (VCDPA). Virginia’s privacy law takes some influence from the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR). In turn it has influenced other state laws like the Connecticut Data Privacy Act (CTDPA).

What Is the Virginia Consumer Data Protection Act (VCDPA)?

The Virginia Consumer Data Protection Act (VCDPA) was signed into law on March 2, 2021, and came into effect on January 1, 2023, the same day as California’s Consumer Privacy Rights Act (CPRA), that state’s second data privacy law.

The VCDPA is a comprehensive state privacy law that protects the personal data of Virginia residents when they act in an individual or household context, rather than a commercial or employment one. It governs how controllers collect and process consumers’ personal data, including consent, opt-outs, and requests relating to consumers’ privacy rights.

Who Has to Comply with the VCDPA?

The VCDPA applies to organizations that do business in Virginia, or that produce products or services targeted to residents of Virginia, if, during a calendar year, they:

• Control or process personal data of 100,000 or more consumers during a calendar year, or

• Control or process personal data of 25,000 or more consumers and derive more than 50 percent of their gross revenue from the sale of that personal data

Companies that meet these requirements do not have to be headquartered in the state for the Virginia privacy law to apply, as the law is extraterritorial.

Exemptions to the Virginia Data Privacy Law

The following types of businesses do not have to comply with the VCDPA:

• Bodies, authorities, boards, bureaus, commissions, districts, or agencies of the Commonwealth of Virginia or political subdivision of the Commonwealth
• Financial institutions or data that are subject to Title V of the federal Gramm-Leach-Bliley Act (GLBA), which requires companies to safeguard consumers’ sensitive data and explain their information-sharing practices
• Covered entities or business associates governed by the Health Information Technology for Economic and Clinical Health Act (HITECH) and the Health Insurance Portability and Accountability Act (HIPAA)
• Non-profit organizations
• Institutions of higher learning

VCDPA Definitions

The Virginia data privacy law defines various key terms that explain who the law impacts and what activities fall under its ambit.

VCDPA Controller

Controller under the VCDPA means the “natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.”

VCDPA Processor

Closely tied to the controller is the processor, defined as “a natural or legal entity that processes personal data on behalf of a controller.” A controller may do their own data processing or a third party, like a vendor or service provider, may act as the processor and do it for them. Such a relationship includes data safeguards and contractual requirements under the VCDPA.

VCDPA Processing

Another key definition in the VCDPA is that of processing, which refers to what is being done with or to consumers’ data once collected. The law defines it as “any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.”

VCDPA Consumer

A consumer under the Virginia privacy law is defined as: “a natural person who is a resident of the Commonwealth of Virginia acting only in an individual or household context.” This definition specifically excludes a natural person acting in a commercial or employment context.

VCDPA Sale 

Sale is defined as “the exchange of personal data for monetary consideration by the controller to a third party.”

Like Utah’s law, this definition excludes “other valuable consideration” options as a sale, as well as these types of transactions that disclose personal data:

• To a processor working on behalf of the controller
• To a third party as part of a merger, acquisition, bankruptcy, or other transaction
• To a third party to provide a product or service that the consumer has requested
• To an affiliate of the controller
• Of information that the consumer intentionally made available to the general public through a channel of mass media and did not restrict to a specific audience

VCDPA Targeted Advertising

The VCDPA defines targeted advertising as the display of ads to a consumer based on their personal data collected from their “activities over time and across non-affiliated websites or online applications to predict such consumer’s preferences or interests.”

The law excludes:

• Ads where the data used to select the ad is obtained from the consumer’s behavior on the controller’s site or app itself
• Ads that are contextually relevant to the consumer’s current search query, visit to a website, or online application
• Ads displayed to a consumer in response to the consumer’s request for information or feedback
• Processing of personal data solely for the purpose of measuring or reporting advertising performance, reach, or frequency

VCDPA Profiling

Profiling under the law means “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”

This definition encompasses a wide range of activities that could be used to build profiles of individuals and make decisions based on those profiles.

VCDPA Consent

The definition of consent under the VCDPA is similar to that under the General Data Protection Regulation (GDPR), as that regulation’s definition has been globally influential in laws relating to data privacy and/or protection.

Virginia’s data privacy law defines consent as “a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.”

Virginia’s law operates primarily on an opt-out basis, which means that businesses are not typically required to obtain consent before processing consumer data. However, there are specific circumstances outlined in the VCDPA where businesses must obtain prior opt-in consent:

• If the stated purpose for data processing changes
• The data is categorized as sensitive
• The data is that of a known child (under age 13)

The VCDPA Law and Data

Modern privacy laws typically have consistent definitions of what constitutes personal data or information, but there are a number of variations at the granular level. See Personally Identifiable Information (PII) vs. Personal Data – What’s the difference for an in-depth breakdown. There’s also linked vs. linkable personal information, definitions that depend on how many combined data points are needed to establish an individual’s identity.

How Does the VCDPA Define Personal Data?

Personal data under the Virginia data privacy law means “any information that is linked or reasonably linkable to an identified or identifiable natural person.” It specifically excludes de-identified data or publicly available information.

Organizations can collect and process personal data in most cases without consumers’ prior consent, but consumers must have the option to opt out of its sale or use for targeted advertising or profiling at any time.

How Does the VCDPA Define Sensitive Data?

Under Virginia’s privacy law, the following categories qualify as sensitive data, which a controller generally may not process without the consumer’s consent:

• Personal data collected from a known child under the age of 13: Consent to process this data must come from a parent or legal guardian, in line with the requirements of the Children’s Online Privacy Protection Act (COPPA)
• Genetic or biometric data processed for the purpose of uniquely identifying a natural person
• Precise geolocation data, meaning data that directly identifies a person’s specific location within a radius of 1,750 feet (533.4 meters)
• Citizenship or immigration status
• Racial or ethnic origin
• Religious beliefs
• Sexual orientation
• Mental or physical health diagnosis

Since July 1, 2026, controllers may not sell or offer to sell precise geolocation data at all, even with consent.

Data Exemptions to the VCDPA

Not all processed consumer data is subject to the VCDPA, and exemptions can be full or partial. In addition to de-identified and publicly available data, exemptions include:

• Personal data regulated by existing laws, including:
  • Consumer credit check information under the Fair Credit Reporting Act (FCRA)
  • Student data regulated by the Family Educational Rights and Privacy Act (FERPA)
  • Driver’s Privacy Protection Act
  • Farm Credit Act
  • Patient and health information, as well as covered entities and business associates, governed by the Health Insurance Portability and Accountability Act (HIPAA) and other laws
• Personal data of employees, independent contractors, and job applicants, including data collected and used in the context of those roles

In this way Virginia’s privacy law differs a fair bit from the California laws and the GDPR, as they have fewer specific exemptions based on existing laws of more limited scope. These exemptions are, however, similar to those in the laws of Utah, Connecticut, Colorado, and some other states.

What Rights Do Consumers Have Under the VCDPA?

The VCDPA gives consumers several key rights. Controllers also may not discriminate against consumers for exercising these rights, for example by denying goods or services or charging different prices, although bona fide loyalty, rewards, and discount programs are among the permitted exceptions. Building these rights into how a business receives, verifies, and answers requests supports its VCDPA privacy compliance efforts.

VCDPA Consumer Rights

Right to access

Confirm whether or not the controller is processing the consumer’s personal data and access such data, with exceptions

Right to correction

Correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing

Right to delete

Any personal data provided by, or obtained about, the consumer, with exceptions

Right to portability

Obtain a copy of the personal data the consumer previously provided to the controller, in a portable and, to the extent technically feasible, readily usable format, where processing is carried out by automated means, with exceptions

Right to opt out

Opt out of the sale of personal data, targeted advertising, or profiling “in furtherance of decisions that produce legal or similarly significant effects concerning the consumer”

How Can Consumers Exercise Their Rights Under Virginia’s Privacy Law?

Companies have to notify consumers about their rights as well as how to exercise them. This is commonly done with contact information supplied in the privacy policy page or similar on the website. If a controller declines a request, the consumer can appeal the decision. If the appeal is denied, the controller must give the consumer an online mechanism, if available, or another method to contact the Virginia Attorney General’s office and submit a complaint.

The Attorney General’s office handles investigations. Under the VCDPA, there is no private right of action, so consumers cannot sue controllers for alleged violations of the VCDPA. By comparison, California’s CCPA provides a limited private right of action that applies only to certain data breaches.

Under the VCDPA, controllers do not have to give consumers separate notice at the point of collection, which differs from the California laws, although processing sensitive data requires consent. Where consent is not required, a controller can meet the notice requirements through its privacy notice and a clear, accessible way to opt out of the processing.

What Responsibilities Do Businesses Have Under the VCDPA?

Organizations that are required to comply with the provisions of the Virginia data privacy law must fulfill certain requirements based on whether they are a controller or a processor. Obligations for controllers under the VCDPA are as follows.

VCDPA Controller Obligations

Set up and maintain administrative, technical, and physical data security practices

That are reasonable and appropriate to the amount and types of personal data processed in order to protect confidentiality, integrity and accessibility of personal data.

Respond to consumer requests regarding their data within 45 days of receipt of the request

In some cases the response period can be extended by an additional 45 days, but the consumer has to be notified of the need to extend the response period, and the reason for it.

Set up a process for consumers to appeal a refusal to act on a request

And respond in writing within 60 days of receiving an appeal, explaining the reasons for the decision. If the appeal is denied, give the consumer an online mechanism, if available, or another way to contact the Attorney General to submit a complaint.

Limit collection of consumers' personal data to what is “adequate, relevant, and reasonably necessary”

For the purposes that the data is being processed, as disclosed to consumers.

Not process personal data for purposes other than those disclosed to consumers

And that are not reasonably necessary nor compatible with previously disclosed purposes, unless consumer consent has been obtained, and with certain exceptions.

Not process personal data in violation of state and federal laws that prohibit unlawful discrimination

And not discriminate against consumers for exercising their rights, such as by denying goods or services or charging different prices. Bona fide loyalty, rewards, and discount programs are among the permitted exceptions.

Not rely on contract provisions of any kind

That purport to waive or limit consumer rights, as any such provision is void and unenforceable.

Notify the consumers with a reasonably accessible, clear, and meaningful privacy notice

That includes:

• Categories of personal data processed by the controller
• Purpose for processing personal data
• How consumers can exercise their rights, including appeal proceedings
• Categories of personal data that the controller shares with third parties, if any
• Categories of third parties if any, with whom the controller shares personal data

Clearly and conspicuously disclose processing if it sells personal data to third parties

Or processes personal data for targeted advertising or profiling, as well as the manner in which a consumer may exercise the right to opt out of these sales or uses

Establish and describe in a privacy notice

One or more secure and reliable means for consumers to submit a request to exercise their rights

Regarding de-identified (anonymized) data, under the VCDPA controllers have several protective duties:

• To take reasonable measures to prevent it from being associated with an individual (natural person)
• To commit publicly to abstaining from attempting to re-identify the data
• To contractually obligate recipients of de-identified data to comply with VCDPA requirements.

Information that controllers provide in response to a consumer request must be provided at no cost, up to twice each year for each consumer.

VCDPA Controller and Processor Agreements 

Under Virginia’s privacy law, while controllers have responsibilities to consumers, they also need to have contractual agreements with processors. This is similar to GDPR requirements that limit processing to what is necessary and access to those who need it. Each person who processes personal data on a processor’s behalf must be subject to a duty of confidentiality.

A data processing agreement between a controller and processor should cover:

• The rights and obligations of both parties
• Instructions for processing data
• Types of data to be processed
• Nature and purpose of processing
• Duration of processing

Any agreement should also require the processor to:

• Subject each person processing personal data to a duty of confidentiality regarding the data
• Provide all information in its possession, upon reasonable request, to demonstrate that it meets its obligations
• Return or delete all personal data at the controller’s direction once the services are completed, unless retention is required by law
• Allow and cooperate with reasonable assessments by the controller or the controller’s designated assessor of the processor’s policies and organizational or technical measures
• Engage subcontractors only under a written contract that requires them to meet the processor’s obligations with respect to the personal data

Processors’ Duties Under the VCDPA

In addition to the requirements under the agreement, the VCDPA also lays out several obligations of processors towards controllers.

Processors must follow the instructions of the controller and assist the controller in meeting its duties under the VCDPA. The duties of processors under the law are:

• To use appropriate technical and organizational measures to help the controller respond to consumer requests regarding their rights
• To assist the controller in maintaining the security of the personal data and notifying the controller if there is a breach of security
• To provide necessary information to help the controller conduct and document assessments of the data protection measures in place.

The processor must support the controller in managing and protecting the personal data in its care, helping the controller meet its obligations under Virginia’s data privacy law and respond to consumer rights requests. Processors are also subject to the Attorney General’s investigative authority, including civil investigative demands.

The VCDPA and Data Protection Assessments (DPAs)

Controllers must conduct and document a Data Protection Assessment (DPA) when any of the criteria listed below take place:

• Sale of personal data
• Processing of sensitive data
• Processing of personal data presenting a heightened risk of harm to consumers
• Processing for targeted advertising purposes
• Profiling that presents a reasonably foreseeable risk of harm to consumers, such as unfair or deceptive treatment, unlawful disparate impact, or financial, physical, or reputational injury

Since January 1, 2025, a controller that offers an online service, product, or feature directed to consumers it knows are children must also conduct a DPA for that service, product, or feature. It must address the purpose of the service, the categories of known children’s personal data it processes, and the purposes for which that data is processed. An assessment conducted for another law can also satisfy these requirements if it has a reasonably comparable scope and effect.

A DPA is sometimes referred to as a Data Protection Impact Assessment (DPIA), which is what it’s called under the GDPR, for which it is also a requirement.

The Virginia Attorney General may, pursuant to a civil investigative demand, request that a controller disclose a DPA, and the controller must comply.

VCDPA Privacy Notices

Controllers are also responsible for having a privacy notice, e.g. on a privacy policy page, under the VCDPA, which must be reasonably accessible, clear, and meaningful, and include:

• Categories of personal data the controller will process
• Categories of personal data the controller shares with third parties, if any
• Categories of third parties with whom the controller will share personal data, if any
• Purpose of the data processing
• Disclosure regarding data processing for sale, targeted advertising purposes, or profiling, and instructions to enable consumers to opt out

Controllers also need to provide means by which consumers can exercise their rights under Virginia’s data privacy law (including the appeals process) and communicate with the controller. These means need to be “secure and reliable” and have to take into account ways in which the controller and consumers normally interact. Using a link on a website would be reasonable, for example, but a long, bureaucratic process would not.

Controllers also need to be able to reasonably authenticate consumers’ identities if they make requests, and can deny requests if they are not able to do so. Controllers also can’t require consumers to create new accounts in order to make those requests, but can require them to login to an existing account, which helps facilitate verification.

VCDPA Enforcement and Penalties

For any complaints regarding alleged violations of the VCDPA, consumers must contact the Virginia Attorney General’s office, which is responsible for investigating complaints and other allegations of violations and for bringing civil actions.

Consumers do not have a private right of action under Virginia’s data privacy law, so cannot sue companies for alleged or proven violations.

If a controller or processor continues to violate the VCDPA after the cure period, the Attorney General can seek an injunction and civil penalties of up to USD 7,500 per violation, and can recover reasonable expenses, including attorney fees, incurred in investigating and preparing the case. 

Fines under the GDPR can be much higher: up to EUR 10 million or 2 percent of global annual revenue, whichever is higher, for the lower tier, and up to EUR 20 million or 4 percent, whichever is higher, for the upper tier, which covers infringements of core processing principles, consent conditions, data subject rights, and international data transfers.

Before taking action, the Attorney General must give the controller or processor 30 days’ written notice identifying the specific provisions it believes have been violated. If the controller or processor cures the violation within that period and gives the Attorney General an express written statement that the violations have been cured and that no further violations will occur, no action can be brought. Unlike in several other states, where the cure period has expired or been repealed, Virginia’s cure period has no end date.

Outside of official penalties, however, companies accused of breaches or other violations can lose considerable brand reputation, affecting customer acquisition, retention, and revenues.

Comparing the VCDPA to Other State or Federal Data Protection Laws

Like the other state-level data privacy laws in the U.S., the VCDPA relies on notice and opt-out for most processing, rather than the opt-in model associated with the EU’s GDPR. The table compares it with California’s laws and the GDPR on the points that most often affect businesses.

At the federal level, the VCDPA relies on COPPA for the rules on verifiable parental consent for known children under 13, and since January 1, 2025 it also adds its own restrictions on known children’s data. Financial and health data fall mainly under other federal laws, such as the GLBA and HIPAA.

Limitations of Scope

The Virginia data privacy law has more limitations in its scope than the California laws or the GDPR, particularly in how it defers to existing federal and state laws. It also leaves room for interpretation by allowing controllers to collect, use, or retain data for internal operations “reasonably aligned with the expectations of the consumer,” among other purposes.

Under the VCDPA controllers do not have to provide a “clear and conspicuous link” to enable consumers to opt out of the sale of their data, as is required in California and some other states.

The VCDPA also does not require controllers to recognize universal opt-out signals, such as Global Privacy Control (GPC), which a growing number of other states now require. Organizations that already honor these signals elsewhere may choose to apply them to Virginia consumers as well.

The VCDPA does not restrict controllers and processors from taking the following actions:

• Complying with federal, state, and local laws, rules, and regulations
• Complying with civil, criminal, or regulatory inquiries, investigations, subpoenas, or summonses from governmental authorities
• Cooperating with law enforcement agencies about conduct that they reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations
• Investigating, establishing, exercising, preparing for, or defending legal claims
• Providing a product or service the consumer specifically requested, performing a contract to which the consumer is a party, or taking steps at the consumer’s request before entering into a contract
• Taking immediate steps to protect the life or physical safety of the consumer or another person
• Preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or other illegal activity
• Engaging in public or peer-reviewed scientific or statistical research in the public interest, under certain conditions

The VCDPA’s obligations also do not restrict controllers and processors from collecting, using, or retaining data to conduct internal research, effectuate a product recall, repair technical errors, or perform internal operations that are reasonably aligned with the expectations of the consumer.

Updates to the VCDPA

Virginia’s privacy law has been amended several times since its enactment, reflecting the state’s ongoing efforts to expand consumer protections as data practices and technology evolve.

SB 361 and HB 707: Protections for Known Children’s Data

On May 17, 2024, the Governor signed SB 361 and HB 707, which amended the VCDPA to add protections for known children, meaning consumers the controller knows are under 13. The amendments took effect on January 1, 2025. They require verifiable parental consent, obtained in line with COPPA, before a controller processes a known child’s personal data for targeted advertising, sale, or profiling in furtherance of decisions with legal or similarly significant effects, or collects a known child’s precise geolocation data.

They also limit processing of a known child’s data to what is reasonably necessary to provide the online service, product, or feature, to the purposes disclosed at collection or compatible with them, and to the time reasonably necessary.

Precise geolocation data may be collected from a known child only where it is reasonably necessary for the service, for only as long as necessary, and with a signal to the child for the whole period of collection. Controllers that offer an online service, product, or feature directed to consumers they know are children must also conduct a data protection assessment for it.

SB 854: Social Media Time Limits for Minors Under 16

On May 2, 2025, the Governor signed SB 854 into law, amending the VCDPA to regulate minors’ use of social media platforms. The law requires social media platform operators to use commercially reasonable methods, such as a neutral age screen, to determine whether a user is under 16. For users identified as minors, platforms must limit use to one hour per day for each service or application, unless a parent gives verifiable consent to increase or decrease the limit. Platforms may not use the information collected to determine age for any other purpose. The law took effect on January 1, 2026.

On February 27, 2026, a federal court in NetChoice v. Jones enjoined the Attorney General from enforcing the law against NetChoice members, finding that it likely violates the First Amendment. The Fourth Circuit denied Virginia’s requests to stay the injunction and heard argument on the appeal on October 28, 2026. Until the court rules, the time limits remain blocked for NetChoice members. The case concerns only the social media provisions, and the rest of the VCDPA is unaffected.

SB 338: Sale of Precise Geolocation Data Prohibited 

On April 13, 2026, the Governor signed SB 338 into law, further amending the VCDPA to prohibit controllers from selling, or offering to sell, consumers’ precise geolocation data. The prohibition took effect on July 1, 2026, and Virginia joined Maryland and Oregon in restricting the sale of this data. Before the amendment, a controller could process and sell precise geolocation data with the consumer’s consent. Consent no longer authorizes a sale, although processing precise geolocation data in other ways still requires consent.

Precise geolocation data retains its existing VCDPA definition: information derived from technology that directly identifies a person’s specific location within a radius of 1,750 feet (533.4 meters). The prohibition applies only to disclosures for monetary consideration. Virginia’s definition of “sale” does not extend to disclosures in exchange for other valuable consideration, distinguishing it from the equivalent restrictions in Maryland and Oregon.

Controllers that disclose precise geolocation data to third parties, for example through advertising partners, SDK providers, or data brokers, should review whether any of those disclosures is made for monetary consideration, because those would now be prohibited sales.

How Consent Infrastructure Supports VCDPA Requirements

Virginia asks businesses for clear notice and a working opt-out for most processing, and for consent in narrower cases. Consent infrastructure, such as a consent management platform (CMP), can help deliver all of these.

Under the VCDPA, controllers can usually collect and process personal data without prior consent. Consent is required to process sensitive data, and to process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes. For known children under 13, controllers must follow COPPA’s parental consent rules.

Four requirements matter most to visitors:

• A clear privacy notice that describes the categories of data processed, the purposes, and the categories of third parties that receive it
• A way to opt out of the sale of personal data, targeted advertising, and certain profiling
• Clear and conspicuous disclosure of any sale or targeted advertising, with instructions for opting out
• Consent before sensitive data is processed

A CMP can help on each front. Usercentrics Web CMP and App CMP can detect the cookies and other tracking technologies in use on websites and apps, present notices and choices in a banner, and show visitors which data categories, services, and third parties are involved. Consent records can also support an organization’s documentation of the choices visitors made.

The VCDPA does not require recognition of universal opt-out signals, but a CMP can be set up to honor signals such as Global Privacy Control where an organization chooses to, for example because it operates in states that require them.

Few businesses answer to a single law. A company operating across the U.S. or abroad may need to meet several privacy laws at once. Geotargeting helps by presenting the right notice and choices based on each visitor’s location, in the visitor’s preferred language. That can support privacy compliance efforts under the VCDPA, other U.S. state laws, and regulations such as the GDPR, which sets stricter consent requirements than U.S. state privacy laws.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.