Virginia Consumer Data Protection Act
Virginia privacy law (VCDPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Only the Attorney General enforces the Act and may issue civil investigative demands. Before suing, the Attorney General must give 30 days' notice and a chance to cure, and this cure right does not expire. Penalties are up to $7,500 per violation, plus injunctions and reasonable investigation costs and attorney fees. There is no private right of action.
Key points
Exclusive Attorney General enforcement.
Section: § 59.1-584(A)
Civil investigative demands available.
Section: § 59.1-583
30-day notice and cure, with a written statement of cure; no sunset.
Section: § 59.1-584(B)
Civil penalties up to $7,500 per violation and injunctions.
Section: § 59.1-584(C)
Recovery of reasonable expenses, including attorney fees.
Section: § 59.1-584(D)
No private right of action.
Section: § 59.1-584(E)
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Virginia statute
Reference material, not legal advice.