DPO SchoolDPO School

Virginia Consumer Data Protection Act

Virginia privacy law (VCDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act covers persons that do business in Virginia or target Virginia residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. There is no revenue-only test. Whole entities are excluded if they are public bodies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA covered entities or business associates, nonprofits, or institutions of higher education. Employee, job applicant and business-to-business contact data fall outside the Act because a consumer acts only in an individual or household context.

Key points

  1. Threshold one: personal data of at least 100,000 consumers in a calendar year.

    Section: § 59.1-576(A)(i)

  2. Threshold two: personal data of at least 25,000 consumers and over 50 percent of gross revenue from the sale of personal data.

    Section: § 59.1-576(A)(ii)

  3. Entity-level exemptions: state and local public bodies, GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and institutions of higher education.

    Section: § 59.1-576(B)

  4. Data-level exemptions include protected health information, FCRA-regulated activity, FERPA data, DPPA data and Farm Credit Act data.

    Section: § 59.1-576(C)

  5. Employment-context data (applicants, employees, contractors, emergency contacts, benefits) is exempt.

    Section: § 59.1-576(C)(14)

  6. A consumer is a Virginia resident acting in an individual or household context, not in a commercial or employment context.

    Section: § 59.1-575

  7. Complying with COPPA verifiable parental consent rules is deemed compliance with the Act's parental consent duties.

    Section: § 59.1-576(D)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Virginia statute

Reference material, not legal advice.