Privacy laws · Virginia

Virginia Consumer Data Protection Act.

Provides consumers with rights to access, correct, delete, and opt-out of data processing for targeted advertising and sale of personal data. Requires data protection assessments for high-risk processing.

/ Diagnostic check ClearConsent scans your storefront for signals related to this law — consent banner state, GPC support, Do Not Sell links, privacy policy disclosures, cookies, and trackers.

/ Effective
2023-01-01
Effective date
When the law took effect or will take effect.
/ Consumers
100,000
Consumer threshold
The number of Virginia residents whose data triggers compliance.
/ Revenue
None
Revenue threshold
Annual revenue trigger for compliance, if applicable.
01 / Key requirements

What the law requires.

  • 01Clear and accessible privacy notice
  • 02Right to access personal data
  • 03Right to correct inaccuracies
  • 04Right to delete personal data
  • 05Right to data portability
  • 06Right to opt-out of targeted advertising
  • 07Right to opt-out of sale of personal data
  • 08Right to opt-out of profiling
  • 09Data protection assessments for high-risk processing
  • 10Contracts with data processors
  • 11Consent for sensitive data processing
  • 12Purpose limitation
02 / Enforcement

Penalties & cure period.

Penalties

Up to $7,500 per violation enforced by Attorney General.

Cure period

30-day cure period

Enforcement agency

Attorney General

03 / E-commerce

What this means for
your store.

Applies if you process data of 100K+ VA consumers OR 25K+ consumers and derive revenue from data sales.

Scan your store for VCDPA privacy gaps →

Run the diagnostic