Virginia CDPA — Consumer Data Protection Act

Why does it matter?

The act's definitions decide most compliance questions. A sale of personal data is an exchange for monetary consideration only (§ 59.1-575), so data shared for other value is not a sale, although targeted advertising still triggers the opt-out and an assessment. Sensitive data, which needs consent, includes any personal data collected from a known child and precise geolocation within 1,750 feet, and since 2026 precise geolocation data may not be sold at all (§ 59.1-578 A 6). Processing a known child's data for targeted advertising, sale or significant profiling needs COPPA-grade parental consent (§ 59.1-578 F), and § 59.1-577.1 now reaches social media platforms used by anyone under 16. The Attorney General's notice-and-cure route is permanent.

Key benefits include:

• Sale means money

Only an exchange of personal data for monetary consideration by the controller to a third party is a sale; disclosures to processors, affiliates, at the consumer's request, of public information or in a merger are not (§ 59.1-575).

• No sale of precise geolocation

Since chapter 820 of the 2026 Acts, a controller may not sell or offer for sale precise geolocation data concerning any consumer, not only a child (§ 59.1-578 A 6).

• Known-child rules since January 1, 2025

No targeted advertising, sale or significant profiling with a known child's data, no processing beyond the disclosed purpose or longer than needed, and no precise geolocation collection without necessity and a visible signal, all subject to COPPA parental consent (§ 59.1-578 F); a data protection assessment for every online service directed to known children (§ 59.1-580 B).

• Social media platforms and minors

A platform must use commercially reasonable methods such as a neutral age screen to identify users under 16 and limit their use to one hour per day per service unless a parent adjusts it, may not degrade or reprice service for the limit, and may use age data only for age purposes (§ 59.1-577.1, chapter 703 of 2025); check the section's enforcement status before relying on it.

• Cure, then $7,500

Thirty days' written notice from the Attorney General identifies the provisions; a controller that cures and gives an express written statement avoids an action, while a continuing violation or a breach of that statement brings injunctions and civil penalties of up to $7,500 per violation plus expenses and attorney fees (§ 59.1-584).

How does it work?

Section 59.1-577 A lists the rights a controller must honor: learn whether personal data is processed and see it, have inaccuracies corrected, have data provided by or obtained about the consumer deleted, take a portable copy of data the consumer supplied, and opt out of targeted advertising, the sale of personal data and profiling for decisions with legal or similarly significant effects. The controller responds within 45 days, may take one further 45 days if it gives a reason, answers free twice a year, may charge for or refuse manifestly unfounded requests, and explains any refusal (§ 59.1-577 B). Appeals are decided in writing within 60 days, and a denial must point to the Attorney General (§ 59.1-577 C).

Section 59.1-578 A sets the controller's duties: limit collection to what is adequate, relevant and reasonably necessary; obtain consent before processing for purposes neither necessary to nor compatible with those disclosed; keep reasonable administrative, technical and physical data security practices appropriate to the data; not penalize a consumer for exercising a right; obtain consent for sensitive data, with COPPA governing a known child; and not sell precise geolocation data. The privacy notice lists the categories processed, the purposes, how to exercise rights and appeal, the categories shared and the categories of third parties (C); sales and targeted advertising are clearly disclosed with the opt-out (D); request methods are secure and reliable and need no new account (E).

Processors follow the controller's instructions, help with rights requests, security and breach notification under § 18.2-186.6, supply what assessments need, and work under a binding contract that sets out the processing instructions, its nature, purpose, data types and duration, both parties' rights, confidentiality, assessments and subcontractor flow-down (§ 59.1-579). Data protection assessments under § 59.1-580 cover targeted advertising, sales, profiling with foreseeable risks, sensitive data and other heightened-risk processing, weigh benefits against risks as mitigated by safeguards, are producible to the Attorney General under a civil investigative demand, stay confidential, and apply to processing created after January 1, 2023. Penalties and fees go to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund (§ 59.1-584 C).

Key Elements

• Scope and exemptions (§ 59.1-576)

Business in Virginia or targeted products, with the 100,000-consumer or 25,000-consumer-plus-50-percent-sales threshold; Commonwealth bodies, GLBA institutions and data, HIPAA entities, nonprofits and institutions of higher education excluded; fourteen exempt data categories; COPPA consent deemed compliant.

• Definitions (§ 59.1-575)

Consumer, consent, controller, processor, known child, personal and sensitive data, precise geolocation data (1,750 feet), profiling, sale of personal data (monetary consideration), social media platform, targeted advertising, de-identified and pseudonymous data.

• Rights and appeals (§ 59.1-577)

Access, correction, deletion, portability and opt-out; 45 days plus one 45-day extension; two free responses a year; authentication; a conspicuous appeal process decided within 60 days with a route to the Attorney General.

• Controller duties (§ 59.1-578)

Minimization, purpose limitation, security practices, non-discrimination, consent for sensitive data, no sale of precise geolocation data, void waivers, the five-item notice, sale and targeted advertising disclosure, request methods, and the known-child rules in subsection F.

• Processor contracts (§ 59.1-579)

Assistance duties and the binding contract terms, including deletion or return, compliance information, assessments or an independent assessor's report, and subcontractor contracts; role is a fact-based determination.

• Data protection assessments (§ 59.1-580)

Five processing categories plus services directed to known children; a benefit-against-risk weighing; one assessment for comparable operations; assessments under other laws count if comparable; civil investigative demand production; confidential; not retroactive before January 1, 2023.

What does it cover?

Section 59.1-576 A applies the act to persons that conduct business in the Commonwealth or produce products or services targeted to Virginia residents and that, in a calendar year, control or process the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. Subsection B exempts Commonwealth and local government bodies, financial institutions and data under Title V of the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations and institutions of higher education. Subsection C exempts fourteen data categories, including protected health information, research data, FCRA, DPPA, FERPA and Farm Credit Act data and employment records.

What are its objectives?

The General Assembly's summary of the 2021 act states what it does.

Establish a framework for controlling and processing personal data in the Commonwealth, with responsibilities and privacy protection standards for controllers and processors.

Grant consumers rights to access, correct, delete and obtain a copy of personal data and to opt out of targeted advertising, sale and profiling.

Exempt state and local government and data governed by federal law.

Give the Attorney General exclusive enforcement authority, since 2024 with added protections for known children and since 2026 a ban on selling precise geolocation data.

Framework in Context

The VCDPA shares its controller, processor, sensitive-data and assessment vocabulary with the other state consumer privacy acts, among them the Utah Consumer Privacy Act, so one request workflow and one assessment template can serve several states, but Virginia's monetary-only sale definition, its 60-day appeal clock, the known-child subsection, the social media section and the 2026 geolocation sale ban are its own. Section 59.1-579 A 2 ties processors to Virginia's breach notification statute, § 18.2-186.6, and § 59.1-580 D to the Attorney General's civil investigative demand power. The Attorney General's Consumer Protection Section receives complaints, and the act gives no private right of action (§ 59.1-584 E).

Common Framework Mappings

Mapping the VCDPA to the frameworks below lets a privacy program reuse its Virginia notice, request, assessment and processor evidence wherever the same concepts recur.

Mapped frameworks include:

APEC PF

CCPA/CPRA

CPA (CO)

CTDPA

GDPR

ISO 27701

NIST Privacy Framework v1.0

Utah UCPA