Virginia Data Removal Guide (2026)
Virginia was the second US state, after California, to enact comprehensive privacy legislation. The VCDPA, effective since January 2023, gives Virginia residents enforceable rights over personal data held by data brokers meeting the law's scope thresholds.
At a glance
- Comprehensive state privacy law
- Yes — VCDPA
- Broker response deadline
- 45 days from verifiable request
- Enforcement
- Virginia Office of the Attorney General
- Residents
- 8.7M (approx.)
Virginia Consumer Data Protection Act (VCDPA)
VCDPA applies to persons conducting business in Virginia who process personal data of 100,000+ Virginia consumers, or 25,000+ consumers while deriving 50%+ of revenue from selling personal data. Rights include access, deletion, correction, portability, and opt-out of targeted advertising, sale, and profiling. The law is enforced exclusively by the Attorney General with a 30-day cure period and civil penalties up to $7,500 per violation. No private right of action.
Your rights
- →Right to delete personal data (§ 59.1-577)
- →Right to opt out of sale, targeted ads, and profiling
- →Right to appeal denied requests
- →AG exclusive enforcement, $7,500/violation
Where your data leaks from in Virginia
Data brokers don\u2019t guess your address \u2014 they scrape specific public-record sources. The ones most relevant in Virginia:
- Fairfax, Virginia Beach, and Richmond property records
- Virginia Judicial System Case Information
- Virginia DMV driver records
- Virginia Department of Health vital records
Ready to remove
Opt out of 200+ brokers for $2
OfflistMe drafts a legally compliant deletion email citing VCDPA for every broker. You send from your own inbox. No account, no ID upload.
Start for $2 \u2192If a broker ignores your request
If a broker does not respond within 45 days, file a complaint with the Virginia Office of the Attorney General. The enforcement authority can assess civil penalties and compel compliance.
File a complaint with Virginia Office of the Attorney General \u2197FAQ: Virginia data removal
How is VCDPA different from California's CCPA?+
VCDPA is narrower — it does not include a private right of action, has higher scope thresholds, and does not cover employee/B2B data. But response windows and deletion rights are functionally similar for most consumer data broker requests.
Can I sue a data broker under VCDPA?+
No. VCDPA has no private right of action. All enforcement runs through the Virginia Attorney General's office. File complaints at oag.state.va.us.