---
title: "Virginia privacy law (VCDPA): controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/virginia/controller-duties"
source: "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Virginia Consumer Data Protection Act

# Virginia privacy law (VCDPA): controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, avoid unlawful discrimination, and publish a clear privacy notice. They must conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing, and for online services directed to known children. The Act does not require controllers to honor universal opt-out signals.

## Key points

1. Data minimisation: adequate, relevant and reasonably necessary; no incompatible secondary use without consent.

   Section: [§ 59.1-578(A)(1) to (2)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

2. Privacy notice must list data categories, purposes, how to exercise and appeal rights, categories of data shared with third parties and the categories of those third parties.

   Section: [§ 59.1-578(C)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

3. Sale and targeted advertising must be disclosed clearly and conspicuously with the opt-out method.

   Section: [§ 59.1-578(D)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

4. Secure and reliable request methods; no new account may be required.

   Section: [§ 59.1-578(E)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

5. Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; available to the Attorney General on a civil investigative demand.

   Section: [§ 59.1-580(A), (D)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

6. Assessments also required for online services directed to known children.

   Section: [§ 59.1-580(B)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

7. No universal opt-out signal requirement appears in the Act; an authorized agent mechanism is also not provided for opt-outs.

   Section: [§§ 59.1-577 to 59.1-578](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

## Sources

- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/)
- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-580/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-580/)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Virginia statute](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

Reference material, not legal advice.

## Other topics for Virginia

- [Applicability](https://dposchool.com/state-privacy-laws/state/virginia/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/virginia/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/virginia/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Virginia](https://dposchool.com/state-privacy-laws/state/virginia) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/virginia/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents