---
title: "Virginia privacy law (VCDPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data"
source: "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Virginia Consumer Data Protection Act

# Virginia privacy law (VCDPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to identify a person, data collected from a known child, and precise geolocation data. Processing it requires the consumer's consent, or COPPA-compliant processing for a known child. Since 1 July 2026 a controller may not sell precise geolocation data at all. Since 1 January 2025, extra limits apply to known children under 13, and a 2025 amendment adds a one-hour daily limit for social media users under 16.

## Key points

1. Sensitive data categories include health diagnosis, sexual orientation, citizenship or immigration status, identifying genetic or biometric data, known-child data and precise geolocation.

   Section: [§ 59.1-575](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

2. Opt-in consent required to process sensitive data; for a known child, processing must follow COPPA.

   Section: [§ 59.1-578(A)(5)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

3. Sale of precise geolocation data is prohibited (from 1 July 2026).

   Section: [§ 59.1-578(A)(6)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

4. A child is a person under 13.

   Section: [§ 59.1-575](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

5. For known children: no targeted advertising, sale or significant-effect profiling, and limited precise geolocation collection, unless a parent consents under COPPA.

   Section: [§ 59.1-578(F)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

6. Social media platforms must screen age and limit users under 16 to one hour a day per service unless a parent consents to change it (enforcement reported enjoined; see notes).

   Section: [§ 59.1-577.1(A) to (B)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

## Sources

- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/)
- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/)
- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577.1/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577.1/)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Virginia statute](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

Reference material, not legal advice.

## Other topics for Virginia

- [Applicability](https://dposchool.com/state-privacy-laws/state/virginia/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/virginia/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/virginia/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Virginia](https://dposchool.com/state-privacy-laws/state/virginia) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents