DPO SchoolDPO School

Virginia Consumer Data Protection Act

Virginia privacy law (VCDPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, avoid unlawful discrimination, and publish a clear privacy notice. They must conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing, and for online services directed to known children. The Act does not require controllers to honor universal opt-out signals.

Key points

  1. Data minimisation: adequate, relevant and reasonably necessary; no incompatible secondary use without consent.

    Section: § 59.1-578(A)(1) to (2)

  2. Privacy notice must list data categories, purposes, how to exercise and appeal rights, categories of data shared with third parties and the categories of those third parties.

    Section: § 59.1-578(C)

  3. Sale and targeted advertising must be disclosed clearly and conspicuously with the opt-out method.

    Section: § 59.1-578(D)

  4. Secure and reliable request methods; no new account may be required.

    Section: § 59.1-578(E)

  5. Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; available to the Attorney General on a civil investigative demand.

    Section: § 59.1-580(A), (D)

  6. Assessments also required for online services directed to known children.

    Section: § 59.1-580(B)

  7. No universal opt-out signal requirement appears in the Act; an authorized agent mechanism is also not provided for opt-outs.

    Section: §§ 59.1-577 to 59.1-578

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Virginia statute

Reference material, not legal advice.