The Virginia Consumer Data Protection Act (VCDPA) is Virginia’s comprehensive consumer privacy law, codified at Va. Code § 59.1-575 et seq. Signed in March 2021 and in effect since January 1, 2023, it was the second state privacy law after California’s. It gives Virginia residents rights over their personal data and requires opt-in consent before a business processes sensitive data.

Any business that operates in Virginia or targets Virginia residents and, in a calendar year, controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers while earning over 50% of gross revenue from selling personal data. Government bodies, nonprofits, higher education institutions, financial institutions covered by the Gramm-Leach-Bliley Act, and HIPAA-regulated entities are exempt.

Virginia consumers can confirm and access the personal data a business holds, correct it, delete it, and get a portable copy. They can also opt out of targeted advertising, the sale of their data, and profiling that produces legal or similarly significant effects. Businesses must respond within 45 days, with one 45-day extension, and must offer an appeal process.

Sensitive data is personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify a person; data from a known child; and precise geolocation. Businesses need opt-in consent before processing it, and since July 1, 2026, selling precise geolocation data is banned outright.

No. Unlike Colorado, Connecticut, and Texas, Virginia does not require businesses to honor universal opt-out signals such as Global Privacy Control. Virginia consumers can still opt out of targeted advertising and sale directly, and every tracker on your site must respect that choice. Sites that serve several states usually honor Global Privacy Control anyway, so a tracker that ignores it is a multi-state risk.

The Virginia Attorney General enforces the law exclusively and can seek civil penalties of up to $7,500 per violation, plus injunctions and investigation costs, including attorney fees. There is no private right of action. Before suing, the Attorney General must give 30 days’ written notice, and a business that cures the violation within that window and confirms it in writing avoids the action.

Reflectiz monitors your website remotely, with no code changes, and inventories every script, pixel, and cookie that collects personal data. It flags trackers that keep sharing data for targeted advertising or sale after a consumer opts out, detects sensitive data collected without opt-in consent, and maps every third- and fourth-party vendor that receives the data. Your privacy notice states the policy. Reflectiz shows what your site actually does.