Virginia Consumer Data Protection Act (VCDPA)

Virginia's comprehensive privacy law, in force since 1 January 2023. 2026 amendment effective 1 July 2026 prohibits the sale of precise geolocation data.

JurisdictionVirginia
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Virginia Consumer Data Protection Act (VCDPA) establishes several key requirements for businesses:

  • Consumer Rights: The VCDPA grants Virginia residents specific rights, including:
  • Right to access personal data
  • Right to correct inaccuracies
  • Right to delete personal data
  • Right to obtain a copy of personal data
  • Right to opt-out of personal data processing for targeted advertising, sale, or profiling

Source: [Virginia Legislative Information System]

  • Consent for Sensitive Data: Businesses must obtain explicit consent before processing sensitive data, which includes racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data, and precise geolocation data

Source: [Virginia Attorney General's Office]

  • Data Protection Assessments: Controllers must conduct and document data protection assessments for certain processing activities, including targeted advertising, sale of personal data, profiling, and processing sensitive data

Source: [Virginia Secretary of Commonwealth]

  • Privacy Notices: Businesses must provide clear, accessible privacy notices detailing data collection practices, purposes, sharing, and consumer rights

Source: [International Association of Privacy Professionals]

Compliance Challenges

Organizations face several challenges in complying with the VCDPA:

  • Data Mapping and Inventory: Many businesses struggle to accurately identify and categorize all personal data they collect and process

Source: [PwC VCDPA Readiness Survey]

  • Consent Management: Implementing systems to obtain and manage explicit consent for sensitive data processing can be complex

Source: [Deloitte VCDPA Compliance Guide]

  • Technical Implementation: Businesses report difficulties in implementing data access, deletion, and portability mechanisms

Source: [IAPP-EY Annual Privacy Governance Report]

Implementation Best Practices

To effectively implement VCDPA requirements:

  • Conduct a comprehensive data inventory to identify all personal and sensitive data processing activities

Source: [NIST Privacy Framework]

  • Implement a robust consent management platform to handle opt-ins for sensitive data processing

Source: [OneTrust Consent Management Solution]

  • Develop and document data protection assessment procedures for high-risk processing activities

Source: [IAPP Data Protection Assessment Template]

  • Create clear and accessible privacy notices that comply with VCDPA requirements

Source: [FTC Guidance on Privacy Notices]

Recent Updates

As of February 2025, there have been no significant amendments to the VCDPA since its enactment. However:

  • The Virginia Attorney General's office released updated enforcement guidance in December 2024, clarifying interpretation of certain provisions

Source: [Virginia Attorney General's Office VCDPA Guidance]

  • A proposed amendment to strengthen data broker regulations under the VCDPA is currently under consideration in the Virginia legislature, with potential implementation in 2026

Source: [Virginia Legislative Information System - Proposed Amendments]

Related Regulations

The VCDPA shares similarities with other state and international privacy laws:

  • California Consumer Privacy Act (CCPA): Both laws grant similar consumer rights, but CCPA has broader applicability

Source: [California Attorney General's CCPA Page]

  • EU General Data Protection Regulation (GDPR): VCDPA borrows concepts from GDPR but has less stringent requirements overall

Source: [European Commission GDPR Portal]

  • Colorado Privacy Act (CPA): Shares many provisions with VCDPA, including data protection assessments

Source: [Colorado Department of Law CPA Information]

Industry Impact

The VCDPA has significant impacts across various industries:

  • Retail and E-commerce: These sectors face challenges in managing consumer consent for targeted advertising and data sales

Source: [National Retail Federation VCDPA Analysis]

  • Healthcare: While HIPAA-covered entities are exempt, non-covered health tech companies must navigate VCDPA compliance

Source: [American Health Law Association VCDPA Healthcare Impact]

  • Financial Services: The act impacts customer data management practices, particularly for institutions not fully covered by GLBA exemptions

Source: [American Bankers Association VCDPA Guide]

Sources

Recent developments

  • — Virginia Attorney General Jay Jones said his office will fully enforce the VCDPA’s new social-media rules for minors, including age-screening and a one-hour daily limit for users under 16 unless a parent consents. The AG also said companies will receive 30-day cure notices before litigation, signaling active enforcement. (source)
  • — The Virginia Attorney General publicly opposed federal legislation that would weaken state privacy protections, framing the stance as support for Virginia’s existing privacy enforcement framework. The release underscores the state’s position that the VCDPA and related state privacy rules should remain strong and enforceable. (source)
  • — New VCDPA provisions took effect on January 1, 2026, including restrictions on social-media platform operators’ treatment of minors. The law requires commercially reasonable age-verification methods and limits minors’ daily use to one hour unless a parent approves more time. (source)
  • — An amendment to the VCDPA took effect adding new protections for children and tightening rules for processing personal data of known children under 13. This marked an important policy update expanding the statute beyond its original consumer-rights framework. (source)
  • — The VCDPA’s child-privacy amendments became effective, creating additional compliance obligations for controllers handling minors’ data. Industry guidance around the law highlighted that businesses would need to adjust notice, consent, and data-handling practices accordingly. (source)
  • — The Virginia Attorney General reminded residents of their VCDPA rights to access, correct, delete, and obtain copies of personal data, as well as opt out of targeted advertising and data sales. The notice also directed consumers to file complaints with the Attorney General’s Office, indicating continued enforcement attention. (source)

Read the full guide to Virginia Consumer Data Protection Act (VCDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates