---
title: "Virginia privacy law (VCDPA): overview"
canonical: "https://dposchool.com/state-privacy-laws/state/virginia"
source: "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Comprehensive state privacy law

# Virginia privacy law

Virginia Consumer Data Protection Act

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

- **Citation:** Va. Code Ann. §§ 59.1-575 to 59.1-584
- **Official text:** https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/
- **Enacted:** March 2, 2021. [2021 Acts, Sp. Sess. I, cc. 35 and 36 (HB 2307 and SB 1392)](https://legacylis.virginia.gov/cgi-bin/legp604.exe?212+sum+SB1392)
- **In force:** January 1, 2023
- **Effective dates:**
  - **January 1, 2023:** main provisions (chapter 36 approved 2 March 2021, effective 1 January 2023)
  - **January 1, 2023:** data protection assessments apply only to processing activities created or generated after this date (§ 59.1-580(G))
- **Enforcer:** Attorney General (exclusive)
- **Private right of action:** No. The chapter expressly gives no private right of action for its violations or under any other law (§ 59.1-584(E)).
- **Cure period:** 30 days. Before suing, the Attorney General must give 30 days' written notice. No action follows if the controller or processor cures within 30 days and gives an express written statement that the violation is cured and will not recur. The cure right has no end date. (§ 59.1-584(B))
- **Rulemaking:** No. The chapter grants no rulemaking power. The Attorney General publishes a plain-language summary (current as of 1 July 2026).

## Amendments

- [2022 Acts, c. 423](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577/) (in force July 1, 2022). A controller that obtained data from a third-party source can satisfy a deletion request by keeping a minimal suppression record or by opting the consumer out of processing (§ 59.1-577(B)(5)). Date is the default 1 July effective date for regular-session acts.
- [2022 Acts, cc. 451 and 452](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-584/) (in force July 1, 2022). Repealed the Consumer Privacy Fund section (§ 59.1-585) and redirected civil penalties to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund (§ 59.1-584(C)); amended definitions. Date is the default 1 July effective date for regular-session acts.
- [2024 Acts, cc. 840 and 844 (HB 707 and SB 361)](https://legacylis.virginia.gov/cgi-bin/legp604.exe?241+sum+HB707) (in force January 1, 2025). Children's protections: for a known child (under 13), no targeted advertising, sale or significant-effect profiling, no processing beyond what is necessary or disclosed, and limits on precise geolocation collection, unless a parent consents under COPPA (§ 59.1-578(F)); data protection assessment for online services directed to known children (§ 59.1-580(B)).
- [2025 Acts, c. 703 (SB 854)](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577.1/). New § 59.1-577.1: social media platforms must use commercially reasonable age screening and limit users under 16 to one hour a day per service unless a parent gives verifiable consent to change the limit. In-force date not confirmed on an official page (see notes); its enforcement is reported to be preliminarily enjoined in federal court.
- [2026 Acts, c. 820 (SB 338)](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/) (in force July 1, 2026). Controllers may not sell or offer for sale a consumer's precise geolocation data (§ 59.1-578(A)(6)).

## Topics

- [Applicability](https://dposchool.com/state-privacy-laws/state/virginia/applicability): The Act covers persons that do business in Virginia or target Virginia residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. There is no revenue-only test. Whole entities are excluded if they are public bodies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA covered entities or business associates, nonprofits, or institutions of higher education. Employee, job applicant and business-to-business contact data fall outside the Act because a consumer acts only in an individual or household context.
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights): Consumers may confirm and access, correct, delete, and obtain a portable copy of data they provided, and may opt out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects. Controllers must respond within 45 days, extendable once by 45 more days with notice and reasons. Responses are free up to twice a year. A refusal must explain how to appeal, and the controller must decide the appeal in writing within 60 days and point the consumer to the Attorney General if it denies it.
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data): Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to identify a person, data collected from a known child, and precise geolocation data. Processing it requires the consumer's consent, or COPPA-compliant processing for a known child. Since 1 July 2026 a controller may not sell precise geolocation data at all. Since 1 January 2025, extra limits apply to known children under 13, and a 2025 amendment adds a one-hour daily limit for social media users under 16.
- [Controller duties](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties): Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, avoid unlawful discrimination, and publish a clear privacy notice. They must conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing, and for online services directed to known children. The Act does not require controllers to honor universal opt-out signals.
- [Processors](https://dposchool.com/state-privacy-laws/state/virginia/processors): A processor must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, information to show compliance, cooperation with assessments (or an independent assessment arranged by the processor), and flow-down contracts with subcontractors.
- [Enforcement](https://dposchool.com/state-privacy-laws/state/virginia/enforcement): Only the Attorney General enforces the Act and may issue civil investigative demands. Before suing, the Attorney General must give 30 days' notice and a chance to cure, and this cure right does not expire. Penalties are up to $7,500 per violation, plus injunctions and reasonable investigation costs and attorney fees. There is no private right of action.

## Sources

- [Code of Virginia, Title 59.1, Chapter 53 (Consumer Data Protection Act), full chapter](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)
- [LIS bill history, SB 1392 (2021 Special Session I), chapter 36](https://legacylis.virginia.gov/cgi-bin/legp604.exe?212+sum+SB1392)
- [LIS bill history, HB 707 (2024), chapter 840](https://legacylis.virginia.gov/cgi-bin/legp604.exe?241+sum+HB707)
- [Office of the Attorney General of Virginia, VCDPA summary (current as of 1 July 2026)](https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-7-1-26.pdf)
- [Law-firm and news reports on SB 854 (2025) and the federal preliminary injunction (used only to find leads)](https://privacymatters.dlapiper.com/2026/03/virginias-social-media-time%E2%80%91limit-law-for-minors-blocked-key-takeaways/)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Virginia statute](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

Reference material, not legal advice.

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Virginia

Previous: [California](https://dposchool.com/state-privacy-laws/state/california)

Next: [Colorado](https://dposchool.com/state-privacy-laws/state/colorado)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents