Virginia Consumer Data Protection Act
VCDPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Numerical threshold.
Core threshold: 100,000 consumers; or 25,000 consumers and >50% gross revenue from sale
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out profiling | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Consent required
Current code includes additional duties for known children, including restrictions on targeted advertising, sale, profiling, retention and precise geolocation, plus child-focused assessments.
Business obligations
Minimization, purpose limitation, reasonable security, privacy notice, processor governance, sensitive-data consent and data protection assessments.
Enforcement
Authority: Virginia Attorney General
Private right of action: No
Penalty / remedy baseline: Up to $7,500 per violation after statutory cure process
What makes Virginia different?
Virginia was an early model for later state privacy laws, but it is no longer static: amendments now add substantial child/minor protections, making the current code materially richer than the original 2021 enactment.
Developments to watch
The 2026 code includes amended definitions and minors provisions. Current code should be used rather than older summaries.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.