Virginia, United States
Consumer Data Protection Act
Virginia CDPA: What your website needs to offer Virginia customers
Virginia’s Consumer Data Protection Act gives Virginia residents rights over their personal data and applies to businesses that meet its own volume tests. For a website, the Virginia-specific points are the thresholds, the targeted advertising opt-out, opt-in consent for sensitive data and a written appeal process.
At a glance
- Who it can apply to
- Businesses operating in or targeting Virginia that process personal data of 100,000+ Virginia consumers a year, or 25,000+ with over 50% of gross revenue from data sales. Nonprofits and some regulated entities are exempt.
- What it is
- A state consumer privacy law: the Virginia Consumer Data Protection Act (Code of Virginia § 59.1-575 and following), enforced by the Attorney General.
- Choices to offer
- Opt-outs for targeted advertising, sale and significant profiling. Opt-in consent for sensitive data, and parental consent under COPPA for known children under 13.
- Website actions
- Record your scope decision against Virginia’s own thresholds.
- Disclose and test a targeted advertising and sale opt-out.
- Get consent before processing sensitive data, and never sell precise geolocation data.
- Answer requests within 45 days and offer a written appeal.
- Document assessments for targeted advertising, sale and sensitive data.
- Primary sources
- Code of Virginia: Consumer Data Protection Act; Virginia Attorney General: VCDPA summary (current as of July 1, 2026)
- Last reviewed
Does the CDPA apply to your business?
The law covers businesses that operate in Virginia or target products or services to its residents and that, in a calendar year:
- Volume test: control or process personal data of at least 100,000 consumers; or
- Data-sale test: control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data.
Consumers are Virginia residents acting in a personal or household capacity, not in a business or employment role. Count them, not page views. There is no revenue-only test.
The scope provision exempts nonprofits, institutions of higher education, public bodies, GLBA-regulated financial institutions and HIPAA covered entities, as well as specific data such as protected health information and employee data.
How do Virginia’s definitions differ from California’s?
| Term | Virginia meaning | What to check |
|---|---|---|
| Sale | Virginia meaningExchanging personal data for money with a third party; processors and affiliates excluded. | What to checkDeals where a partner pays for data. |
| Targeted advertising | Virginia meaningAds selected using a person’s activity over time across non-affiliated websites or apps. | What to checkRetargeting and audience uploads; contextual ads and ad measurement are excluded. |
| Precise geolocation | Virginia meaningLocation accurate within 1,750 feet (about 530 meters). | What to checkLocation SDKs and store finders. |
| Child | Virginia meaningUnder 13; no general rule for older minors. | What to checkServices that may attract children. |
California’s CCPA differs: it has a revenue test, counts other valuable consideration as a sale and regulates “sharing” for cross-context behavioral advertising. Keep the CCPA assessment separate.
How should the targeted advertising opt-out work?
If you sell personal data or use it for targeted advertising, Virginia requires a clear and conspicuous disclosure of that activity and of how to opt out. Consumers can also opt out of profiling with legal or similarly significant effects.
The opt-out has to reach the activity, not just the banner. Example: an online shop builds ad audiences from browsing and purchase data. When a Virginia customer opts out, both the retargeting tag and the nightly customer-list upload need to stop using their data, while orders and support continue.
Virginia’s statute does not require you to recognize browser signals such as Global Privacy Control. Honoring GPC is a practical choice here, not a CDPA requirement.
When do you need consent?
The controller duties require consent before you process sensitive data: data revealing racial or ethnic origin, religious beliefs, a health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify someone; a known child’s data; and precise geolocation data.
Consent means a clear affirmative act that is freely given, specific, informed and unambiguous. It is also needed for purposes neither reasonably necessary for nor compatible with those you disclosed.
July 1, 2026 change: an amendment to § 59.1-578 (2026 Acts of Assembly, chapter 820) prohibits selling or offering to sell a consumer’s precise geolocation data. Consent does not lift this ban.
Since January 1, 2025, a known child’s data may be used for targeted advertising, sale or significant profiling only with verifiable parental consent under COPPA. Collecting a known child’s precise geolocation also needs that consent, must be necessary for the service and requires a visible signal while it lasts.
How must you handle requests and appeals?
Consumers can access, correct and delete their data (including data obtained about them), get a portable copy of data they provided and opt out. Your privacy notice must describe a secure and reliable way to make requests, and you cannot require a new account.
Respond within 45 days, or extend once by 45 days with reasons given inside the first period. Responses are free up to twice a year.
If you decline, explain why and how to appeal. Under the consumer rights provision, the appeal route must be conspicuous and similar to the request process. Answer appeals in writing within 60 days; if you deny one, tell the consumer how to complain to the Attorney General.
Which activities need a documented assessment?
The assessment provision requires a documented data protection assessment for targeted advertising, sale, sensitive data, risky profiling, other high-risk processing and online services directed to known children. Weigh benefits against risks and record your safeguards.
Website checklist
- Scope: record which test you meet, or which exemption applies, with the date.
- Opt-out: opt out as a test user; retargeting tags and audience exports should stop for that user.
- Sensitive data: walk through forms and location features; nothing in these categories should be processed before consent is recorded.
- Geolocation: check contracts and SDKs; none should sell precise location data.
- Appeal drill: decline a test request and appeal it; the written denial should explain how to contact the Attorney General.
- Assessments and processors: review assessments and processor contracts when a tool or purpose changes.
FAQ
We process data of fewer than 100,000 Virginia consumers. Can we ignore the CDPA?
Generally yes, unless you meet the 25,000-consumer data-sale test. Other laws and contracts may still apply, so reassess as you grow.
Do all cookies need prior consent in Virginia?
No. The CDPA has no general cookie consent rule. Consent applies to sensitive data and incompatible purposes; advertising and sale need a working opt-out.
Can we ask for ID before acting on a request?
Only as far as needed. If you cannot authenticate a request with commercially reasonable efforts, you may ask for the information reasonably necessary to do so.
Is there still a cure period in Virginia?
Yes. The Attorney General must give 30 days’ written notice and cannot sue if you cure the violation and confirm this in writing. Otherwise penalties reach $7,500 per violation. There is no private right of action.
Does Virginia have privacy rules for teenagers?
The CDPA’s child rules cover known children under 13. A separate section of the same chapter limits social media use by under-16s from January 1, 2026; a federal court preliminarily blocked its enforcement against NetChoice members in February 2026, so social media services should check its current status.