Privacy Laws
Virginia
VA
Virginia Consumer Data Protection Act
VCDPA
Provides consumers with rights to access, correct, delete, and opt-out of data processing for targeted advertising and sale of personal data. Requires data protection assessments for high-risk processing.
Effective Date
2023-01-01
Enforcement
Attorney General
Consumer Threshold
100,000 consumers
Revenue Threshold
No threshold
Key Requirements
Clear and accessible privacy notice
Right to access personal data
Right to correct inaccuracies
Right to delete personal data
Right to data portability
Right to opt-out of targeted advertising
Right to opt-out of sale of personal data
Right to opt-out of profiling
Data protection assessments for high-risk processing
Contracts with data processors
Consent for sensitive data processing
Purpose limitation
Penalties
Up to $7,500 per violation enforced by Attorney General.
Cure Period
30-day cure period
E-commerce Relevance
Applies if you process data of 100K+ VA consumers OR 25K+ consumers and derive revenue from data sales.