The Virginia Consumer Data Protection Act was the second comprehensive state privacy law and the template most other states copied. It applies to businesses that control or process personal data of at least 100,000 Virginia consumers a year, or 25,000 consumers if more than half of gross revenue comes from selling personal data.
What the Virginia Consumer Data Protection Act Requires
Covered businesses must post a privacy notice covering data categories, purposes, sharing, and consumer rights, honor requests to access, correct, delete, and port personal data within 45 days, obtain opt-in consent before processing sensitive data such as health, biometric, or precise location data, and offer opt-outs from targeted advertising, sale, and significant profiling. Data protection assessments are required for higher-risk processing. Amendments effective July 1, 2025 added protections for known minors, requiring consent before processing their data for targeted advertising or sale.
Enforcement and Penalties
The Attorney General enforces exclusively, with a permanent 30-day cure period and civil penalties up to $7,500 per violation. There is no private right of action and no requirement to recognize universal opt-out browser signals.
Source: Virginia Law Portal: SB 1392, Va. Code 59.1-575 et seq.
Report a violation: If you believe a business is violating this law, you can file a complaint with the Virginia Attorney General Consumer Protection Section.
