Virginia Data Removal Guide (2026)
Virginia was the second US state, after California, to enact comprehensive privacy legislation. The VCDPA, effective since January 2023, gives Virginia residents enforceable rights over personal data held by data brokers meeting the law's scope thresholds.
Research status: published state guide pending fresh official-source re-verification.
This page is educational orientation, not legal advice. Scope, exemptions, deadlines, penalties, regulator powers and broker routes can change. Verify the current statute and state regulator guidance before relying on a right or deadline.
At a glance
- Comprehensive state privacy law
- Recorded: VCDPA
- Broker response deadline
- 45 days in this research snapshot for qualifying requests; extensions and exemptions may apply
- Enforcement
- Virginia Office of the Attorney General
Virginia Consumer Data Protection Act (VCDPA)
VCDPA applies to persons conducting business in Virginia who process personal data of 100,000+ Virginia consumers, or 25,000+ consumers while deriving 50%+ of revenue from selling personal data. Rights include access, deletion, correction, portability, and opt-out of targeted advertising, sale, and profiling. The law is enforced exclusively by the Attorney General with a 30-day cure period and civil penalties up to $7,500 per violation. No private right of action.
Read the full VCDPAexplainer →Scope, thresholds, exceptions, cure rules, and enforcement details where documented.
What rights do Virginia residents have?
- →Right to delete personal data (§ 59.1-577)
- →Right to opt out of sale, targeted ads, and profiling
- →Right to appeal denied requests
- →AG exclusive enforcement, $7,500/violation
Where does your data leak from in Virginia?
The FTC explains that people-search sites may combine public records, public social profiles, and information from other brokers. The examples below are a research snapshot, not an exhaustive or person-specific source map for Virginia:
- Fairfax, Virginia Beach, and Richmond property records
- Virginia Judicial System Case Information
- Virginia DMV driver records
- Virginia Department of Health vital records
Generate requests in under 60 seconds
Generate requests for 1009 US/global broker workflows for $9
What if a broker ignores your request?
If a qualifying request does not receive a response within the applicable window, review the current extension and exemption rules, then consider the Virginia Office of the Attorney General complaint route. The authority's jurisdiction and available remedies vary.
File a complaint with Virginia Office of the Attorney General ↗FAQ: Virginia data removal
How is VCDPA different from California's CCPA?+
VCDPA is narrower, has no private right of action, uses its own scope thresholds, and excludes some employee and B2B data. It provides access and deletion rights for covered requests, but the controller, request, response period, and exceptions must be evaluated under the statute rather than assumed to match California.
Can I sue a data broker under VCDPA?+
No. VCDPA has no private right of action. All enforcement runs through the Virginia Attorney General's office. File complaints at oag.state.va.us.