---
title: "Virginia privacy law (VCDPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/virginia/applicability"
source: "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Virginia Consumer Data Protection Act

# Virginia privacy law (VCDPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Act covers persons that do business in Virginia or target Virginia residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. There is no revenue-only test. Whole entities are excluded if they are public bodies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA covered entities or business associates, nonprofits, or institutions of higher education. Employee, job applicant and business-to-business contact data fall outside the Act because a consumer acts only in an individual or household context.

## Key points

1. Threshold one: personal data of at least 100,000 consumers in a calendar year.

   Section: [§ 59.1-576(A)(i)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

2. Threshold two: personal data of at least 25,000 consumers and over 50 percent of gross revenue from the sale of personal data.

   Section: [§ 59.1-576(A)(ii)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

3. Entity-level exemptions: state and local public bodies, GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and institutions of higher education.

   Section: [§ 59.1-576(B)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

4. Data-level exemptions include protected health information, FCRA-regulated activity, FERPA data, DPPA data and Farm Credit Act data.

   Section: [§ 59.1-576(C)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

5. Employment-context data (applicants, employees, contractors, emergency contacts, benefits) is exempt.

   Section: [§ 59.1-576(C)(14)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

6. A consumer is a Virginia resident acting in an individual or household context, not in a commercial or employment context.

   Section: [§ 59.1-575](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

7. Complying with COPPA verifiable parental consent rules is deemed compliance with the Act's parental consent duties.

   Section: [§ 59.1-576(D)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

## Sources

- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/)
- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Virginia statute](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

Reference material, not legal advice.

## Other topics for Virginia

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/virginia/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/virginia/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Virginia](https://dposchool.com/state-privacy-laws/state/virginia) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents