Virginia did something that privacy professionals had been expecting for years: it joined California in turning consumer data rights into a real, state-level legal framework. The Virginia Consumer Data Protection Act, often called the VCDPA or CDPA, was signed into law in 2021 and became effective on January 1, 2023. It was widely described as a CCPA-like consumer privacy law because it gives residents rights over their personal data, requires covered companies to be more transparent, and places limits on how businesses collect, use, sell, and share information.
But here is the important part: Virginia did not simply photocopy California’s Consumer Privacy Act, slap a “Virginia is for Privacy Lovers” sticker on it, and call it a day. The VCDPA borrows ideas from the CCPA, the California Privacy Rights Act, the GDPR, and the proposed Washington Privacy Act, but it creates its own structure. It is narrower in some places, stricter in others, and very practical in how it treats business compliance.
For consumers, the law is about control. For businesses, it is about accountability. For privacy teams, it is another reminder that American privacy law is becoming less like one big federal road and more like a cross-country trip with different speed limits in every state. Buckle up, check your consent settings, and maybe bring snacks.
What Is the Virginia Consumer Data Protection Act?
The Virginia Consumer Data Protection Act is a comprehensive privacy law that applies to certain businesses handling the personal data of Virginia residents. It gives eligible consumers the right to access, correct, delete, obtain, and opt out of certain uses of their personal data. It also requires covered organizations to maintain privacy notices, limit unnecessary data collection, protect sensitive information, and conduct data protection assessments for higher-risk processing activities.
In plain English, the law tells businesses: if you collect a lot of consumer data, you need to explain what you are doing, avoid overcollecting information, honor consumer requests, and be prepared to justify risky data practices. That may sound simple, but anyone who has ever tried to find the “unsubscribe” button in a marketing email knows the internet sometimes treats simplicity like a suspicious package.
Why Virginia’s Law Is Called CCPA-like
Virginia’s privacy law is often compared with the California Consumer Privacy Act because both laws give consumers specific rights over personal information and require businesses to disclose key data practices. Both laws also reflect a broader shift in the United States: privacy is no longer just a company policy buried in tiny gray text. It is becoming a legal obligation with deadlines, documentation, and enforcement.
The comparison makes sense, but it should not be pushed too far. California’s privacy framework is broader in some ways, especially after the California Privacy Rights Act expanded the original CCPA. Virginia’s law has its own thresholds, exemptions, definitions, and enforcement model. For example, Virginia does not include a general revenue threshold like California’s law. Instead, the VCDPA focuses on the number of consumers whose data is controlled or processed and whether the business derives substantial revenue from selling personal data.
Who Must Comply With the Virginia Privacy Law?
The VCDPA applies to businesses that conduct business in Virginia or offer products or services targeted to Virginia residents and meet one of two thresholds. A company may be covered if it controls or processes personal data of at least 100,000 Virginia consumers in a calendar year. A company may also be covered if it controls or processes personal data of at least 25,000 Virginia consumers and derives more than 50 percent of gross revenue from the sale of personal data.
This means a large business is not automatically covered simply because it has a big bank account. Size matters, but the nature and volume of data processing matter more. A niche online service with heavy data activity could fall within the law, while another large company with limited Virginia consumer data might not.
Who Is Not Covered?
The VCDPA includes several important exemptions. It does not apply to Virginia government bodies, nonprofit organizations, institutions of higher education, certain financial institutions or data subject to the Gramm-Leach-Bliley Act, and certain healthcare entities or data regulated by HIPAA and related health privacy rules. It also exempts various categories of data already regulated under laws such as the Fair Credit Reporting Act, the Family Educational Rights and Privacy Act, and the Driver’s Privacy Protection Act.
These exemptions matter because they prevent privacy law overlap from becoming a regulatory lasagna: too many layers, too much cheese, and everyone needs a nap afterward.
What Counts as Personal Data?
Under Virginia’s privacy law, personal data generally means information that is linked or reasonably linkable to an identified or identifiable person. This can include names, online identifiers, device information, purchase behavior, location data, and other information that can point back to a person. Publicly available information and de-identified data are generally treated differently.
The law also creates a special category for sensitive data. Sensitive data includes information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to uniquely identify someone, personal data collected from a known child, and precise geolocation data.
That last category is worth pausing on. Precise location data can reveal more than where a person is standing. It can reveal where they worship, work, seek medical care, go to school, or spend Friday night pretending they are “just browsing” at Target. That is why sensitive data receives stronger protections.
Consumer Rights Under the VCDPA
The Virginia Consumer Data Protection Act gives residents several core rights. These rights allow consumers to understand what companies know about them and to push back against certain uses of their personal data.
Right to Confirm and Access
Virginia consumers may ask whether a covered business is processing their personal data. If the answer is yes, they may request access to that data. This right helps consumers move from guessing to knowing. Instead of wondering whether a company has stored their shopping history, account details, or profile information, they can ask directly.
Right to Correct
Consumers may request correction of inaccurate personal data. This is especially important when incorrect data could affect recommendations, account access, eligibility decisions, or personalized services. A typo in a name is annoying; a wrong address, age, or profile category can create bigger problems.
Right to Delete
Consumers may request deletion of personal data provided by or obtained about them. This right is broader than many people expect because it can include data collected from sources other than the consumer. Companies need systems that can locate data across platforms, vendors, backups, analytics tools, and customer databases. In other words, “just delete it” is easy to say and sometimes a full-body workout to execute.
Right to Data Portability
The law allows consumers to obtain a copy of certain personal data in a portable and usable format when processing is carried out by automated means. This right supports consumer mobility. If a person wants to move data from one service to another, the law aims to reduce unnecessary friction.
Right to Opt Out
Virginia consumers may opt out of processing for targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. This is one of the most important parts of the law for digital advertising, marketing technology, data brokers, and businesses that use automated decision-making tools.
How Businesses Must Respond to Consumer Requests
Covered businesses must respond to authenticated consumer requests without undue delay and generally within 45 days. If reasonably necessary, the business may extend the response period once by another 45 days, but it must tell the consumer about the extension and explain the reason. The law also requires businesses to provide a process for appealing denied requests.
If a company declines a consumer request, it must explain why and provide instructions for appeal. Once an appeal is received, the business must respond in writing within 60 days. If the appeal is denied, the business must tell the consumer how to contact the Virginia Attorney General to submit a complaint.
This appeal requirement is one of Virginia’s more practical and consumer-friendly features. It prevents privacy rights from becoming a one-click dead end. A consumer should not have to decode a corporate “no” that sounds like it was written by a committee of haunted printers.
Business Duties: Transparency, Security, and Data Minimization
The VCDPA does not only create consumer rights. It also tells controllers how they must behave when handling personal data. Covered businesses must limit collection to data that is adequate, relevant, and reasonably necessary for disclosed purposes. They must avoid processing data for incompatible purposes unless they obtain consumer consent. They must also maintain reasonable administrative, technical, and physical security practices appropriate to the volume and nature of the personal data involved.
Privacy notices are central to compliance. A covered business must provide a reasonably accessible, clear, and meaningful privacy notice explaining the categories of personal data processed, the purposes of processing, how consumers can exercise their rights, the categories of personal data shared with third parties, and the categories of third parties receiving the data. If the business sells personal data or uses it for targeted advertising, it must clearly disclose that activity and explain how consumers can opt out.
Sensitive Data Requires Consent
One of the most important differences between Virginia’s law and some other privacy frameworks is its treatment of sensitive data. Covered businesses generally may not process sensitive data without consumer consent. For known children, the law ties consent obligations to the federal Children’s Online Privacy Protection Act.
This consent requirement forces businesses to slow down before using the most personal categories of information. A company should not quietly process precise geolocation data, biometric identifiers, or health-related signals and hope nobody notices. Under Virginia’s model, sensitive data deserves a louder “yes,” not a silent shrug.
Data Protection Assessments: The Homework Businesses Cannot Skip
The VCDPA requires data protection assessments for certain higher-risk processing activities. These include processing for targeted advertising, selling personal data, processing personal data for certain types of profiling, processing sensitive data, and other activities involving personal data that present a heightened risk of harm to consumers.
A data protection assessment is essentially a structured risk review. The business must weigh the benefits of processing against potential risks to consumer rights, while considering safeguards that can reduce those risks. This is where privacy compliance becomes more than updating a webpage. Companies need to document their reasoning, evaluate harms, and show that they thought carefully before launching risky data practices.
For example, if an online retailer wants to use browsing history, purchase history, and location data to create hyper-personalized advertising segments, it may need to assess whether that processing creates privacy risks. If a financial technology company uses automated profiling to make decisions that significantly affect consumers, it may need to evaluate accuracy, fairness, discrimination risks, security safeguards, and consumer expectations.
Controllers, Processors, and Contracts
Virginia’s law uses the familiar controller and processor structure. A controller determines the purpose and means of processing personal data. A processor handles personal data on behalf of the controller. This distinction matters because responsibilities differ depending on the role.
Processors must follow controller instructions and help controllers meet obligations related to consumer requests, security, breach-related duties, and data protection assessments. The relationship must be governed by a contract that addresses processing instructions, purpose, duration, data type, confidentiality, deletion or return of data, subcontractors, and assessment rights.
For businesses, this means vendor management becomes privacy management. A company cannot outsource data work and then pretend the data went on vacation. If vendors process personal data, contracts, oversight, and accountability need to be in place.
Enforcement: Who Holds Businesses Accountable?
The Virginia Attorney General has exclusive authority to enforce the VCDPA. There is no private right of action, meaning individual consumers cannot directly sue under the VCDPA for violations. Before bringing an enforcement action, the Attorney General generally provides 30 days’ written notice identifying the alleged violation. If the controller or processor cures the violation and provides a written statement that the issue has been fixed and will not happen again, enforcement action may be avoided.
If a business continues violating the law after the cure period or breaks its written cure statement, the Attorney General may seek an injunction and civil penalties of up to $7,500 per violation. For companies processing data at scale, that number can become very real, very quickly. Privacy fines are like popcorn: one piece is small, but a whole bucket can ruin your shirt and your budget.
How Virginia Differs From California’s CCPA and CPRA
The VCDPA and California’s privacy laws share a family resemblance, but they are not identical twins. California uses the term “personal information,” while Virginia uses “personal data.” California’s framework includes broader coverage in several areas and has a dedicated privacy agency. Virginia relies on Attorney General enforcement and excludes employee and commercial-context data from the definition of consumer.
Virginia’s definition of sale is also narrower because it focuses on exchanges of personal data for monetary consideration. California’s approach includes monetary or other valuable consideration, which can capture more data-sharing arrangements. On the other hand, Virginia requires opt-in consent for sensitive data, a strong protection that businesses must not overlook.
The lesson is simple: a company that complies with California law is not automatically finished in Virginia. It has a head start, not a hall pass. Privacy teams should map requirements state by state and build a flexible program that can handle differences without reinventing the wheel every time a legislature discovers cookies are not just dessert.
What the Law Means for Consumers
For Virginia residents, the VCDPA creates a practical toolkit. Consumers can ask what data is being processed, request corrections, seek deletion, obtain portable copies, and opt out of targeted advertising, sales, and certain profiling. These rights are especially useful when dealing with online retailers, subscription services, apps, advertising platforms, and other businesses that collect large amounts of data.
Consumers should look for privacy notices, account privacy settings, “Your Privacy Choices” links, or request forms. When submitting a request, they should be specific about which right they want to exercise and be prepared for identity verification. If a company denies the request, consumers should review the appeal process and escalate when appropriate.
What the Law Means for Businesses
For businesses, the VCDPA is a signal that privacy compliance should be built into everyday operations. Companies should inventory personal data, identify whether they meet coverage thresholds, update privacy notices, review targeted advertising practices, create consumer request workflows, train customer service teams, and examine vendor contracts.
Businesses should also review whether they process sensitive data and whether consent mechanisms are clear, specific, and documented. A buried checkbox with confusing language is not a strategy; it is a future meeting with legal counsel. Companies should also prepare data protection assessments for high-risk activities and keep records organized enough to respond if regulators ask questions.
Practical Examples of VCDPA Compliance
Example 1: An E-commerce Brand
An online store selling to Virginia residents may collect names, addresses, purchase history, browsing behavior, and email engagement data. If it processes data from enough Virginia consumers, it may need to provide a clear privacy notice, allow access and deletion requests, and offer opt-outs for targeted advertising. If it uses third-party ad networks to build behavioral profiles across websites, it should pay close attention to opt-out rights and assessment duties.
Example 2: A Fitness App
A fitness app may process health-related information, location data, device identifiers, and user activity patterns. If covered by the VCDPA, it should determine whether any data qualifies as sensitive. If precise geolocation or health diagnosis information is involved, consent may be required. The app should also avoid collecting more data than necessary. Nobody needs a treadmill app that knows your location, your pulse, your coffee order, and your deepest fear of leg day.
Example 3: A Marketing Technology Provider
A marketing technology vendor may act as a processor for business clients or as a controller for its own purposes. Its role depends on the facts. Contracts should clearly define responsibilities, processing instructions, security duties, confidentiality requirements, subcontractor rules, and support for consumer rights requests. Role confusion is dangerous because privacy law is not impressed by vague hand-waving.
Common Mistakes Businesses Should Avoid
One common mistake is assuming that a privacy policy copied from another state is enough. Virginia has specific requirements, including appeal rights, sensitive data consent, and data protection assessments. Another mistake is forgetting vendor contracts. If processors cannot support deletion, access, or security obligations, the controller may have a compliance problem.
Businesses also sometimes underestimate the operational side of privacy requests. A consumer request is not just an email. It may require authentication, database searches, identity matching, review of exemptions, response drafting, and logging. Companies should build repeatable workflows before requests arrive. Fire drills are more fun when they are not happening during an actual fire.
Experience-Based Insights: What Privacy Teams Learn From Virginia’s CCPA-like Law
Working with a CCPA-like privacy framework such as Virginia’s VCDPA teaches one lesson very quickly: privacy compliance is not a document; it is a system. Many organizations begin by updating their privacy notice, which is necessary, but the real challenge starts when someone asks, “Can we actually do what the notice says?” If the notice promises deletion, the business needs to know where data lives. If it promises opt-outs, marketing systems need to honor them. If it promises appeal rights, customer support must know what an appeal is and where to send it. A beautiful privacy policy with no operational backbone is just a decorative umbrella in a hurricane.
One practical experience many teams face is data discovery. At first, leaders may believe data is neatly stored in one customer database. Then the mapping exercise begins, and suddenly personal data appears in analytics dashboards, CRM notes, support tickets, email platforms, payment tools, fraud prevention logs, cloud backups, and spreadsheets named things like “final_customer_list_REAL_FINAL_v7.” The VCDPA encourages companies to clean up that chaos. The best privacy programs usually begin with a data inventory that answers basic questions: what data is collected, why it is collected, where it is stored, who receives it, how long it is kept, and whether it is sensitive.
Another experience involves consent. Teams often discover that consent language must be more specific than they expected. A broad statement such as “we use your data to improve services” may not be enough for sensitive data processing. If a company collects precise geolocation data or biometric identifiers, the consent flow should be clear, separate from unrelated terms, and easy for a consumer to understand. Good consent design is not just legal hygiene; it improves trust. People are more comfortable sharing data when they understand the tradeoff.
Customer service training is another surprisingly important area. Privacy requests often arrive through ordinary channels: a contact form, support chat, email inbox, or even a social media message. If frontline teams do not recognize these requests, deadlines can slip. A well-trained support team can route requests quickly, verify identity appropriately, and avoid promising outcomes before the privacy team reviews the facts.
Vendor management also becomes more serious under the VCDPA. Businesses frequently rely on processors for hosting, analytics, payments, advertising, customer support, and security. Each vendor relationship should be reviewed to confirm that contracts include the required privacy terms and that the vendor can actually support the business’s obligations. A vendor that cannot delete data, restrict subcontractors, or assist with assessments can create hidden risk.
The final experience is cultural. Strong privacy programs work best when product, marketing, legal, engineering, security, and leadership all share responsibility. If privacy is treated as the legal department’s lonely hobby, compliance becomes slow and reactive. If privacy is built into product design, data strategy, and vendor selection, the business can move faster with fewer surprises. Virginia’s law may look like a compliance checklist, but its bigger message is strategic: collect less, explain more, protect better, and respect consumer choices before regulators have to remind you.
Conclusion
Virginia’s adoption of a CCPA-like consumer privacy law marked a major step in the evolution of U.S. privacy regulation. The VCDPA gives Virginia residents meaningful rights over personal data while requiring covered businesses to be transparent, disciplined, and accountable. It shares familiar themes with California’s privacy laws, but it also has its own personality: narrower sales definition, specific scope thresholds, sensitive data consent, mandatory appeal rights, Attorney General enforcement, and data protection assessments for higher-risk processing.
For consumers, the law offers more control in a data-driven economy. For businesses, it raises the bar for responsible data governance. For everyone else, it is another sign that privacy is no longer a side note. It is part of the way modern commerce works. And frankly, after years of pop-ups asking us to accept cookies like they are tiny digital houseguests, stronger privacy rights feel overdue.
Note: This article is for general informational and publishing purposes only. It is based on real publicly available information about the Virginia Consumer Data Protection Act and related U.S. privacy law guidance, but it should not be treated as legal advice.
