What is VCDPA (Virginia Consumer Data Protection Act)?

Virginia was the second US state to pass a comprehensive privacy law, and it chose a different template than California: rather than extending the CCPA, the VCDPA borrowed the GDPR's controller/processor vocabulary and a cleaner rights catalog. That Virginia model — not California's — became the chassis for most subsequent state laws, including Colorado's, Connecticut's, and Utah's.

It applies to businesses that control or process the personal data of at least 100,000 Virginia consumers in a calendar year, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Notably, there is no general revenue threshold — a large company with minimal Virginia data volume may be outside it. 'Consumer' covers individuals acting in a personal or household context, excluding employment and B2B data entirely.

Consumers may access, correct, delete, and obtain a portable copy of their data, and may opt out of targeted advertising, the sale of personal data (defined more narrowly than California's — exchange for monetary consideration), and profiling that produces legal or similarly significant effects. Processing sensitive data — including racial or ethnic origin, religion, health diagnoses, sexual orientation, citizenship or immigration status, genetic and biometric data, children's data, and precise geolocation — requires opt-in consent, a stricter approach than California's limit-use right. Controllers must also conduct data protection assessments for higher-risk processing.

Enforcement belongs exclusively to the Virginia Attorney General — there is no private right of action — with civil penalties up to $7,500 per violation and a permanent 30-day cure period that lets businesses fix noticed violations before penalties attach.