Summarize Virginia privacy laws
Virginia’s principal privacy statute is the Va. Code Ann. §§ 59.1-575 to 59.1-585 (the Virginia Consumer Data Protection Act, or VCDPA). It gives Virginia residents a set of consumer rights over personal data, imposes duties on covered businesses, and is enforced exclusively by the Virginia Attorney General; there is no private right of action.[1][2][3]
Overview
The VCDPA became effective January 1, 2023, and its definitions were updated effective January 1, 2026.[1][2] It applies to controllers that target Virginia residents and meet statutory thresholds: generally, those that control or process personal data of at least 100,000 consumers, or at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.[1]
The statute is a general consumer privacy law, not a comprehensive all-purpose privacy code. It primarily regulates how businesses collect, use, disclose, and honor consumer requests regarding personal data.[1][2]
Key Consumer Rights
Under the VCDPA, Virginia consumers may request that a controller:
- confirm whether the controller is processing their personal data;
- correct inaccuracies;
- delete personal data provided by or obtained about them;
- obtain a copy of the personal data;
- opt out of:
Controllers must provide a reasonably accessible, clear, and meaningful privacy notice explaining categories of data processed, purposes, how to exercise rights, appeal rights, and categories of third parties with whom data is shared.[2]
Sensitive Data
The VCDPA treats certain categories as sensitive data, including:
- racial or ethnic origin;
- religious beliefs;
- mental or physical health diagnosis;
- sexual orientation;
- citizenship or immigration status;
- genetic or biometric data used to uniquely identify a person;
- personal data from a known child; and
- precise geolocation data.[3]
Controllers generally may not process sensitive data without consumer consent, and processing of a known child’s sensitive data must comply with COPPA.[2][3]
Major Exemptions
The Act excludes or limits coverage for several categories of data and entities, including:
- publicly available information;
- HIPAA-regulated protected health information and related health records;
- state and local governments;
- nonprofits;
- institutions of higher education; and
- other entities identified in the statute.[1][2]
Enforcement
The Attorney General has exclusive enforcement authority. A controller or processor notified of a violation has 30 days to cure and provide written confirmation. If the violation is not cured, the Attorney General may bring an action and seek civil penalties of up to $7,500 per violation.[1]
Practical takeaway
In practice, Virginia privacy law is best understood as a consumer rights and data governance regime rather than a broad private-litigation privacy statute. Its main effects are to require privacy notices, honor consumer access/correction/deletion/opt-out requests, obtain consent for sensitive data, and give the Attorney General enforcement authority.[1][2][3]