Virginia Consumer Data Protection Act
Published 18 min read
Virginia’s law starts at 100,000 Virginia consumers a year, or 25,000 with over half your revenue from selling data; past that line it asks for five rights on a 45-day clock, written assessments for risky processing, and gives the Attorney General alone the power to act, after a 30-day cure.
The chapter, section by section
The Virginia Consumer Data Protection Act is short: one chapter of the Code of Virginia, Title 59.1, chapter 53. Read it in this order and you have read the whole law. Each row says what the section does and who in a small firm ends up holding it.
| Section | What it does | Who holds it |
|---|---|---|
| § 59.1-575Definitions | Consumer, sale, sensitive data, targeted advertising, child, profiling. Most scope questions are settled here. | Everyone reading the rest |
| § 59.1-576Scope; exemptions | The two thresholds, the five kinds of body left out entirely, and fourteen kinds of data left out. | You, before anything else |
| § 59.1-577Personal data rights | Five rights, the 45-day answer, the free-twice-a-year rule, the appeal. | Whoever opens the privacy inbox |
| § 59.1-577.1Social media and minors | Age screening and a one-hour daily default for users under 16. | Social media platforms only |
| § 59.1-578Controller duties | Minimisation, security, consent for sensitive data, no sale of precise geolocation, the privacy notice, known-child rules. | The owner of the website and the notice |
| § 59.1-579Controller and processor | What a processor must help with and what the contract between you must say. | Whoever signs vendor contracts |
| § 59.1-580Data protection assessments | Written assessments for five kinds of processing and for services directed to children. | Marketing and product leads |
| § 59.1-581De-identified and pseudonymous data | Public commitment not to re-identify; when rights requests stop at pseudonymous data. | Analytics and data teams |
| § 59.1-582Limitations | What the chapter never stops: legal compliance, fraud and security work, warranties, recalls, internal research. | Counsel, on a denied request |
| § 59.1-583Investigative authority | The Attorney General's civil investigative demand. | Whoever answers the AG |
| § 59.1-584Enforcement | AG only, 30 days' notice to cure, up to $7,500 per violation, no private right of action. | Leadership |
| § 59.1-585Repealed | Repealed by Acts 2022, cc. 451 and 452; nothing to do. | Nobody |
Code of Virginia, Title 59.1, chapter 53, as posted on law.lis.virginia.gov, read 22 Oct 2026. | ||
The law took effect on 1 January 2023 and has been amended since, most recently in 2026. Everything on this page is read from the current posted text, not the 2021 bill.
Who it reaches: two doors in, a long list of ways out
The law starts with a gate and then two doors. The gate: you conduct business in Virginia or produce products or services targeted to its residents. The text does not ask for an office in the state. Then you need to pass through one of two volume tests.
100,000
Virginia consumers whose personal data you control or process during a calendar year.
§ 59.1-576(A)(i)
25,000 + over 50%
Virginia consumers, and over 50 percent of gross revenue from the sale of personal data.
§ 59.1-576(A)(ii)
“This chapter applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.”
There is no revenue test. A firm turning over a few million dollars a year with 120,000 Virginians on its mailing list is inside; a much bigger firm with 30,000 Virginian customers and no data sales is outside. The text also has no carve-out for data processed only to complete a payment, which several later state laws added, so a customer who only ever paid by card still counts.
Who counts as a consumer
A consumer is a Virginia resident “acting only in an individual or household context”. The definition goes on to exclude anyone acting in a commercial or employment context. So the buyer at a Virginia company on your B2B list is not a consumer, and neither is your Virginia-based staff. Count the households and individuals: shoppers, subscribers, app users, patients of a non-HIPAA wellness service.
Out by who you are, or by what the data is
The first five rows below take a whole organisation out of the law. The rest take out a kind of data, so the organisation stays inside for everything else: a bank’s marketing site is out with the bank, but a retailer’s HR file is out while its customer list stays in.
| Left out | What the text covers | Va. Code § 59.1- |
|---|---|---|
| State and local bodies | Any body, board, agency or political subdivision of the Commonwealth | 576(B)(i) |
| Financial institutions | A financial institution, or data, subject to Title V of Gramm-Leach-Bliley | 576(B)(ii) |
| HIPAA covered entities | Covered entities and business associates under the HHS privacy, security and breach rules | 576(B)(iii) |
| Nonprofits | Virginia nonstock corporations, 501(c)(3), (c)(6) and (c)(12) bodies, political organizations, some 501(c)(4)s | 576(B)(iv) |
| Colleges and universities | Public and private institutions of higher education | 576(B)(v) |
| Staff and applicant data | Data held because someone applies to, works for or contracts with you, used in that role; emergency contacts; benefits data | 576(C)(14) |
| Regulated records | Protected health information, FCRA consumer-report activity, FERPA records, Driver's Privacy Protection Act data | 576(C)(1), (10)–(12) |
| Public and de-identified data | Publicly available information and de-identified data are not personal data at all | 575 |
Code of Virginia §§ 59.1-575 and 59.1-576, read 22 Oct 2026. Abridged; the section lists fourteen kinds of exempt data. | ||
Count distinct Virginia individuals and households in your CRM, mailing list and analytics for the last calendar year, leaving out staff and business contacts. Then run the same numbers against every state at once in the which-privacy-laws-apply check, because the Virginia test is only one of several.
Five rights, one appeal, and the clock
A consumer can use these rights at any time by telling you which one they want. A parent or legal guardian can use them for a known child. You act on an authenticated request: one where you have verified, by reasonable means, that the person asking is the person the data is about.
- 1.Confirm and access§ 59.1-577(A)(1)Whether you process their data, and the data itself.
- 2.Correct§ 59.1-577(A)(2)Inaccuracies, weighed against the nature of the data and why you hold it.
- 3.Delete§ 59.1-577(A)(3)Data they gave you and data you obtained about them elsewhere.
- 4.Portable copy§ 59.1-577(A)(4)What they gave you, in a readily usable format, where processing is automated.
- 5.Opt out§ 59.1-577(A)(5)Of targeted advertising, the sale of their data, and profiling behind decisions with legal or similarly significant effects.
The clock, drawn to scale
A request
Answer within 45 days. Or, inside those 45 days, tell the person you need one 45-day extension and why. A refusal, with the reason and how to appeal, is due inside the first 45 days too.
An appeal
Answer in writing within 60 days, with your reasons. If you deny it, tell the person how to complain to the Attorney General, online where that is available.
Va. Code § 59.1-577(B) and (C), read 22 Oct 2026. The bars share one scale.
45 days from receipt of the request, without undue delay. The extension exists only if you send notice of it, with the reason, before those 45 days end; miss that and the first deadline stands. Our DSAR deadline calculator dates both for a Virginia request.
The rules around the rights
- Free, twice a year. Information in answer to a request is free up to twice a year per consumer. For requests that are manifestly unfounded, excessive or repetitive you may charge a reasonable fee or decline, and the burden of showing that is yours (577(B)(3)).
- No authentication, no duty to act. If commercially reasonable efforts cannot authenticate the request, you need not act on it and may ask for more information (577(B)(4)).
- Deleting data you bought or were given. For data obtained from a source other than the consumer, keeping a minimal suppression record, or opting the person out of all non-exempt processing, counts as deletion (577(B)(5)).
- No new account. You may ask a customer to use an existing account, but never to create one to make a request (578(E)).
- No retaliation. No denying goods, charging more or lowering quality because someone used a right; a bona fide loyalty or rewards programme is allowed (578(A)(4)).
Put the appeal route in the same place as the request route, as the text asks: an appeal process “conspicuously available and similar to” the request process. Our guide to data subject requests covers logging, identity checks and what to send.
What a controller must do, every day
The rights only work if the business behind them is run a certain way. Section 59.1-578(A) sets six standing duties for every controller, which is whoever decides why and how the data is processed:
- Collect only what is adequate, relevant and reasonably necessary for the purposes you disclosed.
- Use it for nothing beyond those purposes, or compatible ones, unless the consumer consents.
- Keep reasonable administrative, technical and physical security, scaled to the volume and nature of the data.
- Do not discriminate unlawfully, or against anyone for using a right.
- Do not process sensitive data without consent (for a known child, process it as COPPA requires).
- Do not sell, or offer for sale, a consumer’s precise geolocation data.
A contract term that waives or limits any consumer right is void (578(B)). That includes the fine print of your own terms of service.
The privacy notice: five items
- 1. DataThe categories of personal data you process
- 2. PurposeWhy you process it
- 3. RightsHow consumers exercise their rights, including how to appeal your decision
- 4. Shared dataThe categories of personal data you share with third parties, if any
- 5. RecipientsThe categories of third parties you share it with, if any
Va. Code § 59.1-578(C).
On top of the five items, two more duties land on the notice. If you sell personal data or use it for targeted advertising, disclose that clearly and conspicuously along with how to opt out (578(D)). And describe at least one secure, reliable way to send a request, fitted to how customers already deal with you (578(E)). Our privacy policy checklist sets Virginia’s list beside California’s and the GDPR’s.
Sale means money; targeted advertising has four exceptions
Virginia defines a sale narrowly: the exchange of personal data for monetary consideration to a third party. Handing data to a processor, to an affiliate, or to a third party to deliver what the consumer asked for is not a sale. Targeted advertising is ads chosen from a person’s activity over time across sites you do not own. Ads based on activity on your own sites, on the current search or page, on a request for information, and processing only to measure ad performance are not targeted advertising.
Sensitive data needs consent first
Four categories count as sensitive:
- Data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status
- Genetic or biometric data processed to uniquely identify a person
- Personal data collected from a known child (under 13)
- Precise geolocation: location accurate to within 1,750 feet
“‘Consent’ means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.”
So a pre-ticked box or a line buried in your terms does not do it. An intake form that asks about a health diagnosis needs its own consent step before the answer is stored.
No duty to honour an opt-out preference signal such as Global Privacy Control: none in the chapter. Opt-outs arrive as requests. Several later state laws added the signal duty, so a site that serves several states may honour it anyway.
List every tag and form on your site against the three opt-outs: targeted advertising, sale, significant profiling. Any tag that falls under one needs a disclosure in the notice and an opt-out route that works.
Data protection assessments: the paperwork Virginia added
This is the duty that sets Virginia apart from a notice-and-rights law. For certain processing, you write down what it is for and what it risks. In Virginia “DPA” means data protection assessment, not a processor agreement.
“A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data:”
Assessment screener. Tick what the business does, or load an example. Nothing leaves your browser.
Shop buying ad audiences
1 activity needs a written assessment
- Targeted advertising § 59.1-580(A)(1)
- Each one weighs the benefits to you, the consumer, other stakeholders and the public against the risks to the consumer, as reduced by your safeguards (580(C)).
A reading of Va. Code § 59.1-580, not legal advice.
What the assessment has to do
Section 59.1-580(C) gives the method in one sentence: identify and weigh the benefits of the processing (to you, the consumer, other stakeholders and the public) against the risks to the consumer’s rights, as reduced by the safeguards you can put in place. Factor in de-identified data, what consumers would reasonably expect, the context, and your relationship with them.
Four rules that keep it proportionate
- One document, several operations. A single assessment may cover a comparable set of processing operations with similar activities (580(E)).
- Reuse what you have. An assessment written for another law counts if it has a reasonably comparable scope and effect (580(F)). A GDPR DPIA for the same processing is the obvious candidate.
- Not retroactive. The duty applies to processing activities created or generated after 1 January 2023 (580(G)).
- Private unless the AG asks. The Attorney General can demand a relevant assessment through a civil investigative demand. It stays exempt from Virginia’s Freedom of Information Act, and handing it over waives no attorney-client privilege or work-product protection (580(D)).
The text sets no date for writing it, but the Attorney General can demand it in an investigation, so write it when the processing is planned, date it, and keep it with the vendor contract it relies on. The privacy impact assessment template walks through Virginia’s five activities and the weighing step, and prints the record.
Processors and the contract between you
Your email platform, CRM, help desk and hosting company are processors when they handle data on your instructions. Section 59.1-579 makes them help you: with rights requests, with security and breach notice, and with the information you need for your assessments. Whether a vendor is a processor or a controller is a question of fact about the specific processing, not of what the contract calls it (579(D)).
The contract must be binding and must set out the instructions, the nature and purpose of the processing, the type of data, how long it runs, and both parties’ rights and obligations. It must also make the processor promise five things:
- Confidentiality
- Each person processing the data is under a duty of confidentiality.
- Delete or return
- At your direction, all personal data is deleted or returned at the end of the service, unless law requires keeping it.
- Show compliance
- On reasonable request, the processor makes available the information needed to show it meets the chapter.
- Assessments
- It allows and cooperates with your reasonable assessments, or arranges an independent assessor and gives you the report.
- Subcontractors
- Any subcontractor is engaged under a written contract that passes the same obligations down.
Many vendors publish a data processing addendum; check it against the five clauses above rather than assuming a GDPR version covers them. If you are writing your own, the data processing agreement template includes Virginia’s list.
Children under 13, and teens on social media
A child, in this chapter, is anyone under 13, and the duties attach when you know you are dealing with one. Data collected from a known child is sensitive data, so it is processed as the federal Children’s Online Privacy Protection Act requires, and meeting COPPA’s verifiable parental consent rules counts as meeting any parental consent duty in this chapter (576(D)).
The 2024 amendment, in force since 1 January 2025
Acts 2024, chapter 840, which took effect on 1 January 2025, added limits in 578(F). Unless a parent gives consent under COPPA, a known child’s data may not be processed for targeted advertising, sale or significant profiling; beyond what the online service needs; for an undisclosed purpose; or for longer than the service needs. Precise geolocation from a known child is collected only when the service needs it, only for as long as it does, and with a signal the child can see the whole time. A service directed to known children also needs its own assessment (580(B)).
Section 59.1-577.1, added by Acts 2025, chapter 703, applies to social media platforms as the chapter defines them. It treats users under 16 as minors, asks for a commercially reasonable age check such as a neutral age screen, and limits a minor to one hour a day per service unless a parent changes the limit with verifiable consent. A shop, a newsletter or a booking site is unlikely to meet the definition’s tests.
Effective date from Acts 2024, ch. 840, enactment 2.
Enforcement: the Attorney General, a cure, then penalties
The Attorney General has exclusive authority to enforce the chapter, and nothing in it creates a private right of action (584(A), (E)). A customer cannot sue you under this law; they can complain to the Attorney General, which is why a denied appeal has to tell them how.
Step 1
Investigation
With reasonable cause, the Attorney General issues a civil investigative demand. It can reach your data protection assessments.
§ 59.1-583; 580(D)
Step 2
Written notice
Before any action, 30 days' written notice naming the specific provisions said to be violated.
§ 59.1-584(B)
Step 3
Cure
Fix it within the 30 days and send an express written statement that it is cured and will not recur: no action follows.
§ 59.1-584(B)
Step 4
Action
Keep violating, or break the statement, and the AG can sue for an injunction and civil penalties of up to $7,500 per violation, plus expenses and attorney fees.
§ 59.1-584(C)–(D)
Virginia’s cure period has no end date: every notice still comes with 30 days to put it right. Several later state laws wrote their cure periods to expire. The cure is not a free pass, though. The written statement is a promise, and breaking it is what turns a notice into a lawsuit.
The template other states edited
Of the state laws in our table outside California, Virginia’s took effect first, on 1 January 2023, and most of the later ones share its shape: controller and processor, the same rights, assessments, an attorney general with a cure period. Learn this one and each later law reads as a set of edits. These are the edits that matter most to a small firm.
| Feature | Virginia's text | Where later laws moved it |
|---|---|---|
| Threshold | ≥100,000 consumers in a calendar year; or ≥25,000 consumers + over 50% of gross revenue from selling personal data | Connecticut from 1 Jul 2026: ≥35,000 consumers (excl. payment-only); or controls/processes sensitive data; or offers personal data for sale. Texas: no volume test: processes or sells personal data and is not an SBA small business. |
| Cure period | 30 days, ongoing | Colorado: 60 days, ended 1 Jan 2025. Oregon: ended 1 Jan 2026 (no notice required). |
| Opt-out signal | None in the chapter | Colorado: yes, 1 Jul 2024 (GPC is the only recognised UOOM). Texas: yes (authorized-agent technology incl. browser setting), 1 Jan 2025. |
| Response clock | 45 days + 45 once | Iowa: 90 days + 45 once. |
| Enforcer | Attorney General (exclusive) | Colorado: Attorney General and district attorneys. |
Each state’s statute or attorney general page, read 22 Oct 2026. Selected states only. | ||
Build your process to Virginia’s text, then add each state’s edits as its law reaches you. The US state privacy laws table lists every state we have read, and the Texas guide shows the biggest edit: a scope with no volume test at all.
Virginia on one card
- Full name
- Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575 to 59.1-585
- In force
- 1 Jan 2023
- Who it binds
- ≥100,000 consumers in a calendar year; or ≥25,000 consumers + over 50% of gross revenue from selling personal data
- Who it protects
- Virginia residents acting in an individual or household context
- Rights
- Confirm and access, correct, delete, portable copy, opt out of targeted ads, sale and significant profiling
- Request clock
- 45 days + 45 once; appeals answered within 60 days
- Sensitive data
- Consent before processing
- Assessments
- Five kinds of processing, plus services directed to known children
- Opt-out signal
- None in the chapter
- Enforced by
- Attorney General (exclusive); no private right of action
- Cure period
- 30 days, ongoing
- Penalty
- Up to $7,500 per violation
Code of Virginia as posted on law.lis.virginia.gov, read 22 Oct 2026. Information, not legal advice.
Questions
When did the Virginia Consumer Data Protection Act take effect?
On 1 January 2023. It was enacted in 2021 and has been amended in 2022, 2024, 2025 and 2026, so read the current Code of Virginia text rather than the original bill.
Does it apply to a small business?
Size does not decide it; the count does. There is no revenue or headcount test. A business that conducts business in Virginia or targets its residents is covered at 100,000 Virginia consumers in a calendar year, or at 25,000 if over 50 percent of its gross revenue comes from selling personal data.
Does it cover employee data or business contacts?
No. A consumer is someone acting in an individual or household context, which excludes anyone acting in a commercial or employment context, and § 59.1-576(C)(14) exempts data held about applicants, staff and contractors in that role.
Can a customer sue us under it?
No. Section 59.1-584(E) says the chapter provides no basis for a private right of action. Only the Attorney General enforces it.
Do we have to honour Global Privacy Control for Virginians?
Not under this chapter: there is no opt-out signal duty in it. A Virginian can still opt out by request. Our Global Privacy Control checker shows which states do require it and whether your site responds to the signal.
How is it different from the CCPA?
California’s law also reaches a for-profit business doing business there with revenue over $26,625,000, whatever its customer count, and a business that sells or shares must treat a qualifying opt-out preference signal as a valid opt-out. Virginia has no revenue test and no signal duty, and it asks for consent before sensitive data is processed. Our CCPA guide covers the California side.
Are there Virginia regulations to read as well?
The chapter as posted contains no section giving an agency power to write regulations under it, so the statute text is the rulebook. Check the Attorney General’s site for any guidance before you rely on that.