Virginia Consumer Data Protection Act (VCDPA) Reference Guide

A person doing business in Virginia or targeting products or services to Virginia residents can be covered if it controls or processes data of at least 100,000 consumers in a calendar year. The alternative path is at least 25,000 consumers together with more than 50% of gross revenue from the sale of personal data. Those are different gates; 25,000 alone is insufficient. Virginia Code: § 59.1-576

The statute excludes categories of entities, such as government bodies, nonprofits, higher education institutions, and certain regulated financial and health organizations. Its definition of nonprofit organization also includes political organizations and specified tax-exempt and utility-affiliated organizations; counsel should apply the actual definition rather than assuming every entity qualifies. It also lists data-level exemptions. Counsel should examine both the organization and the specific dataset before classifying a website operation. Virginia Code: exemptions

A website analytics tag does not reveal a company’s consumer count or revenue mix. The scan is evidence about behavior; organizational scope needs a separate legal assessment.

Eligible residents may access, correct, delete and obtain their personal data. They may opt out of targeted advertising, a statutory sale, or profiling connected to a decision with legal or similar significant effect. A controller generally must respond within 45 days and may take one 45-day extension when reasonably necessary and timely explained. Virginia Code: § 59.1-577

Controllers must present a clear privacy notice and disclose targeted advertising or sales and the opt-out method. Processing sensitive data requires consent; the law also requires reasonable security, relevant processor contracts, and data protection assessments for specified high-risk uses. A controller offering an online service, product, or feature directed to known children has an additional assessment duty under § 59.1-580. Virginia Code: controller duties Virginia Code: assessments

For personal data obtained from a source other than the consumer, § 59.1-577 provides two specific ways a controller may be deemed to comply with a deletion request: retain only the minimum record needed to keep the data deleted and use it for no other purpose, or opt the consumer out of other processing except statutory exemptions. This is a rights-handling rule, not an exemption from the direct advertising opt-out. Virginia Code: deletion requests

Virginia defines a “sale of personal data” as an exchange to a third party for monetary consideration, with enumerated exclusions for processors, affiliates and other circumstances. Its targeted-advertising opt-out is a separate route. A tag sent to an advertising vendor might require evaluation under targeting even where it is not a monetary sale. Virginia Code: definitions Virginia Code: rights

List each page, script, cookie, recipient and business purpose. Observe whether post-choice requests continue. Then let counsel classify the data transfer and vendor relationship instead of labeling every marketing request a sale.

The VCDPA gives consumers an opt-out right for targeted advertising and sales and directs controllers to provide a secure, reliable way to submit requests. Its text does not expressly require controllers to recognize a universal Global Privacy Control browser signal. Testing GPC can still help a multistate site keep one consistent privacy architecture, but a Virginia-specific analysis must include the actual consumer request route. Virginia Code: request methods Virginia Code: opt-out rights

Document the visitor’s direct opt-out and any GPC run separately. When a signal test reveals continuing traffic, it identifies an engineering issue; it does not by itself establish a VCDPA violation.

The Virginia Attorney General has exclusive enforcement authority. Before suit, the Attorney General must provide 30 days’ written notice of alleged violations. If the controller or processor cures them in that period and gives the prescribed written assurance, no action is initiated for those violations. Continuing or renewed violations may result in injunctive relief and a civil penalty of up to $7,500 per violation. The VCDPA creates no private right of action. Virginia Code: § 59.1-584

The statute also prohibits selling or offering for sale precise geolocation data concerning a consumer. That is distinct from its general opt-out right and deserves legal review where location signals or SDKs are present. Virginia Code: controller responsibilities

The legal team decides which entities and data uses fall within the VCDPA. The technical team makes the resulting preference work in the browser and downstream integrations. Both need the same tag and recipient inventory.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, notices, vendor contracts, rights-request procedures, sensitive-data obligations and organizational governance belong with qualified privacy counsel.

This guide uses current Code of Virginia sections for scope, definitions, rights, controller duties, assessments, and enforcement. The chapter also contains a separate social-media-platform provision on minors in § 59.1-577.1; its applicability and litigation status require separate review beyond a website tracking scan. It distinguishes direct opt-out rights from a universal browser-signal mandate that the VCDPA does not expressly state.

Prepared by Etalon Editorial Team. Last reviewed October 9, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for scope, exemptions, vendor classification, notices, rights requests, sensitive data, assessments, contracts and governance.