Virginia Data Removal Guide (2026)
Virginia was the second US state, after California, to enact comprehensive privacy legislation. The VCDPA, effective since January 2023, gives Virginia residents enforceable rights over personal data held by data brokers meeting the law's scope thresholds.
At a glance
- Comprehensive state privacy law
- Yes, VCDPA
- Broker response deadline
- 45 days from verifiable request
- Enforcement
- Virginia Office of the Attorney General
- Residents
- 8.7M (approx.)
Virginia Consumer Data Protection Act (VCDPA)
VCDPA applies to persons conducting business in Virginia who process personal data of 100,000+ Virginia consumers, or 25,000+ consumers while deriving 50%+ of revenue from selling personal data. Rights include access, deletion, correction, portability, and opt-out of targeted advertising, sale, and profiling. The law is enforced exclusively by the Attorney General with a 30-day cure period and civil penalties up to $7,500 per violation. No private right of action.
Read the full VCDPA explainer →Thresholds, penalties, cure period, private right of action, enforcement history.
What rights do Virginia residents have?
- →Right to delete personal data (§ 59.1-577)
- →Right to opt out of sale, targeted ads, and profiling
- →Right to appeal denied requests
- →AG exclusive enforcement, $7,500/violation
Where does your data leak from in Virginia?
Data brokers don’t guess your address — they scrape specific public-record sources. The ones most relevant in Virginia:
- Fairfax, Virginia Beach, and Richmond property records
- Virginia Judicial System Case Information
- Virginia DMV driver records
- Virginia Department of Health vital records
Ready to remove
Opt out of 500+ brokers for $7
OfflistMe drafts a legally compliant deletion email citing VCDPA for every broker. You send from your own inbox. No account, no ID upload.
Start for $7 →What if a broker ignores your request?
If a broker does not respond within 45 days, file a complaint with the Virginia Office of the Attorney General. The enforcement authority can assess civil penalties and compel compliance.
File a complaint with Virginia Office of the Attorney General ↗FAQ: Virginia data removal
How is VCDPA different from California's CCPA?+
VCDPA is narrower, it does not include a private right of action, has higher scope thresholds, and does not cover employee/B2B data. But response windows and deletion rights are functionally similar for most consumer data broker requests.
Can I sue a data broker under VCDPA?+
No. VCDPA has no private right of action. All enforcement runs through the Virginia Attorney General's office. File complaints at oag.state.va.us.