Virginia Consumer Data Protection Act

VCDPA

What is VCDPA?

VCDPA is Virginia Data Protection Act (VDPA or VCDPA) was signed into law in March 2021. VCDPA effective date is January 1, 2023.

Virginia became the second state in the US to pass a comprehensive data privacy law after California.

The Virginia Consumer Data Protection Act (VDPA) operates based on the consumer right to opt-out of having personal data collected, processed, and sold.

It also requires companies and organizations to obtain the consent from end-users if they collect or process sensitive personal data.

Who does the VDPA apply to?

It applies to global companies who conduct business in Virginia or produce products or services targeted to Virginia residents.

Either:

Control or process the personal data of at least 100,000 Virginia residents; or
Control or process the personal data of at least 25,000 Virginia residents and derive more than 50% of their gross revenue from the sale of personal data.

Consumer rights under VCDPA

The right to know, access and confirm personal data.
The right to delete personal data.
The right to correct inaccuracies in personal data.
The right to data portability (i.e., easy, portable access to all pieces of personal data held by a company).
The right to opt out of the processing of personal data for targeted advertising purposes.
The right to opt out of the sale of personal data.
The right to opt out of profiling based upon personal data.
The right to not be discriminated against for exercising any of the foregoing rights.

VCDPA enforcement and fines

The VCDPA will be enforced by the Virginia Attorney General and allows for a 30-day cure period, but uncured non-compliance can result in a civil penalty of up to $7,500 per violation.

VDPA and Consent Collection

If your website uses cookies to collect and process personal data from individuals inside the state of Virginia, users must have the option to opt out of that personal data being used for personlized advertising.

The Virginia Consumer Data Protection Act (VDPA) Timeline

The VDPA was signed into law in March 2021.
The VDPA takes effect January 1, 2023.

VCDPA vs CCPA

VCDPA is more like GDPR. The VCDPA’s definition of consent is even word-for-word taken from the EU’s GDPR, requiring the “freely given, specific, informed and unambiguous agreement” to constitute a valid end-user consent.

Consent is requried to processing personal and sensitive personal data.

Other US State Privacy Laws

CCPA: California Consumer Privacy Act, learn more at CCPA
CPRA: California Privacy Rights Act, learn more at CPRA
CPA: Colorado Privacy Act, learn more at CPA
VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
UCPA: Utah Consumer Privacy Act, learn more at UCPA
CTDPA: Connecticut Data Protection Act, learn more at CTDPA
COPPA: Children’s Online Privacy Protection Act, learn more at COPPA

Compare different US State Privacy Laws

How to compliant with and implement the Virginia Consumer Data Protection Act Compliance Solution?

Use a consent management platform like UniConsent to offer consumers full control of data collection, opt-out features, manage the preferences communication.