What Is the Virginia Consumer Data Protection Act?
VCDPA applies to persons conducting business in Virginia who process personal data of 100,000+ Virginia consumers, or 25,000+ consumers while deriving 50%+ of revenue from selling personal data. Rights include access, deletion, correction, portability, and opt-out of targeted advertising, sale, and profiling. The law is enforced exclusively by the Attorney General with a 30-day cure period and civil penalties up to $7,500 per violation. No private right of action.
At a glance
- Full name
- Virginia Consumer Data Protection Act
- Short code
- VCDPA
- Effective date
- January 1, 2023
- Response reference
- 45 days in this snapshot
- Cure period
- 30 days in this snapshot
- Private right of action
- No
- Enforcement
- Virginia Attorney General
- Penalty reference
- Up to $7,500 per violation
- Statutory citation
- Va. Code § 59.1-575 et seq.
Who VCDPA applies to
A business is covered if it meets the applicability thresholds set out in Va. Code § 59.1-575 et seq.. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Controls or processes personal data of at least 100,000 Virginia consumers in a calendar year, OR
- Controls or processes personal data of at least 25,000 Virginia consumers AND derives over 50% of gross revenue from the sale of personal data
Consumer rights under VCDPA
Right to delete personal data (§ 59.1-577)
Right to opt out of sale, targeted ads, and profiling
Right to appeal denied requests
AG exclusive enforcement, $7,500/violation
Notable features (vs. CCPA)
VCDPA was explicitly modeled on the EU's GDPR (consent-based, controller/processor terminology) rather than CCPA. It was the first US state law to require data protection assessments (DPAs) for high-risk processing. Employee and B2B data are excluded, a significant scope difference from CCPA.
Enforcement and penalty reference
Enforcing agency: Virginia Attorney General
Penalty reference: Up to $7,500 per violation
Cure period: Businesses had a 30-day cure period under the original VCDPA; this remains in effect and has not been sunset.
Private right of action: VCDPA has no private right of action. Enforcement is exclusive to the Virginia Attorney General.
Where to file a complaint: Virginia Office of the Attorney General
How to exercise your VCDPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Virginia residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Virginia Office of the Attorney General complaint route at https://www.oag.state.va.us/consumercomplaintform. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a VCDPA privacy request, $9 one-time
FAQ
How is VCDPA different from California's CCPA?+
VCDPA is narrower, has no private right of action, uses its own scope thresholds, and excludes some employee and B2B data. It provides access and deletion rights for covered requests, but the controller, request, response period, and exceptions must be evaluated under the statute rather than assumed to match California.
Can I sue a data broker under VCDPA?+
No. VCDPA has no private right of action. All enforcement runs through the Virginia Attorney General's office. File complaints at oag.state.va.us.
Official sources & citations
Compare with sibling state laws
VCDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: