Virginia CDPA: What your website needs to offer Virginia customers

Does the law apply to your business?

The law generally covers businesses operating in Virginia or producing goods or services targeted to Virginia residents that, during a calendar year:

• Process data at scale: control or process personal data of at least 100,000 consumers; or
• Rely on data sales: control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from selling personal data.

There is no separate general revenue floor. Consumers are people acting in an individual or household context, rather than a commercial or employment context. Entity and data exemptions can materially change the assessment.

Check the Virginia scope provision rather than importing California’s thresholds. Count the relevant consumers and processing, not just visits in an analytics dashboard.

Which website activities need attention?

Identifiers and browsing information can be personal data when linked or reasonably linkable to a person. Review advertising, analytics, accounts, lead forms and connected customer platforms.

Virginia defines sale differently from some other states, focusing on monetary consideration. Targeted advertising has its own definition and opt-out, so “we do not sell data” does not settle your advertising obligations.

The statutory definitions distinguish these activities. Use them to assess each recipient and purpose. Do not assume every advertisement is targeted advertising or that every supplier transfer is a sale.

Five things to get right

1. Publish a notice people can act on

Explain the categories of personal data, purposes, rights and how to exercise them, relevant third-party sharing and the categories of recipients.

Where you sell personal data or process it for targeted advertising, clearly disclose that activity and how to opt out. A customer should not have to understand your tag manager to find the choice.

Keep the notice close to relevant collection points and consistent with actual tools. A new campaign integration should trigger a review of both the data flow and the explanation.

2. Make the opt-outs reach the right activities

Virginia provides opt-outs for targeted advertising, sale and specified profiling connected with legally or similarly significant decisions. These are distinct purposes.

Map each applicable choice to the tools and systems involved. Test whether advertising audience creation or relevant data transfers continue after the choice is saved.

Do not assume a California configuration automatically meets Virginia requirements. The definitions, scope and request process differ. Browser-signal support may be useful, but it does not replace the need to implement Virginia’s applicable rights correctly.

3. Obtain consent for sensitive data where required

Sensitive data has specific statutory categories, including certain health and identity information, precise geolocation and personal data collected from a known child.

The controller duties require consent for sensitive-data processing, subject to the law’s requirements. The current provision also prohibits selling or offering to sell precise geolocation data; consent is not a workaround for that prohibition.

Review forms, location features and audience criteria. Avoid collecting sensitive information merely because an advertising or personalisation tool makes it possible.

4. Prepare for requests and appeals

Consumers have applicable rights to confirm processing, access, correct, delete and obtain portable data, alongside the relevant opt-outs.

The consumer-rights provision sets response and appeal requirements. Establish a way to receive requests, authenticate where appropriate, find relevant information and explain a decision.

Include an appeal route when refusing to act. Test the full process rather than assuming a contact email is sufficient. Avoid collecting more information than needed to handle the request.

5. Review risky uses and processor arrangements

Virginia requires data protection assessments for specified activities, including targeted advertising, sale, sensitive-data processing and certain profiling. The assessment provision explains the relevant categories.

A practical review should identify the benefit, possible harm, safeguards and why the activity is justified. Pair this with appropriate processor contracts and clear instructions. Keep records usable when a tool or purpose changes.

A practical marketing example

A retailer uses purchase history and browsing events to create advertising audiences across unrelated services. A Virginia consumer opts out of targeted advertising.

Check the audience-building process, the browser integration and any later exports. Stopping one pixel will not be enough if a scheduled customer-platform export continues the same covered activity.

The retailer can still assess other lawful uses separately, such as fulfilling an order or providing customer support. Keep those functions distinct so the privacy choice does not unnecessarily break the service.

What to prioritise first

If your team is small, start with a clear scope assessment and your highest-impact data flows. Advertising integrations and sensitive information usually deserve attention before cosmetic changes to banner wording.

Then test the controls and rights process end to end. Keep a short record of the result and repeat the check when you introduce a new recipient, purpose or data category.

Website checklist

• Check scope: apply Virginia’s own thresholds and exemptions.
• Check definitions: distinguish sale, targeted advertising and significant profiling.
• Check notices: explain collection, sharing and available rights.
• Test opt-outs: verify affected activity stops across relevant systems.
• Check sensitive data: obtain required consent and observe specific prohibitions.
• Test requests: include correction, deletion and the appeal route.
• Check assessments: review activities that require a documented risk assessment.
• Review suppliers: align contracts, instructions and actual processing.

FAQ