Privacy Map

Virginia. Comprehensive data protection. Act

VCDPAVirginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.)

In force
Partly verifiedMedium confidence. SB 338 effective date not confirmed (likely 2026-07-01). SB 854 enjoined, so excluded as a separate row.

§1Summary

Synopsis

Gives Virginia consumers rights to access, correct, delete and port data and to opt out of sale, targeted advertising and significant profiling. Controllers must obtain consent for sensitive data and conduct data protection assessments.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
Unique features

Template for most later state laws; excludes employee and B2B data; permanent 30-day cure period.

SaaS relevance

Applies to businesses controlling data of 100,000+ Virginia consumers, or 25,000+ with over 50% revenue from data sales; SaaS processors must sign Art.-28-like contracts.

§2Obligations

Extraterritorial
Yes
Breach notification
See Va. Code § 18.2-186.6 (separate statute)
DPO
No
Cross-border transfers
None
Maximum penalty
$7,500 per violation

§3Dates

Key dates
  • Adopted
  • In force
  • Children's data amendments effective 2025-01-01; SB 854 (2025) minors' social media time limits enjoined 2026-02-27; SB 338 (signed 2026-04-14) bans sale of precise geolocation data.

§4Text and authority

Text
Authority
Virginia Attorney General

§5Where it applies

Domestic law of
Virginia

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. SB 338 effective date not confirmed (likely 2026-07-01). SB 854 enjoined, so excluded as a separate row.