Virginia Consumer Data Protection Act
The VCDPA takes effect January 1, 2023 and will affect companies and organizations that do business in Virginia, or that produce products or services targeted to residents of Virginia.
What is VCDPA?
VCDPA is Virginia Data Protection Act (VDPA or VCDPA) was signed into law in March 2021. VCDPA effective date is January 1, 2023.
Virginia became the second state in the US to pass a comprehensive data privacy law after California.
The Virginia Consumer Data Protection Act (VDPA) operates based on the consumer right to opt-out of having personal data collected, processed, and sold.
It also requires companies and organizations to obtain the consent from end-users if they collect or process sensitive personal data.
Who does the VDPA apply to?
It applies to global companies who conduct business in Virginia or produce products or services targeted to Virginia residents.
Either:
- Control or process the personal data of at least 100,000 Virginia residents; or
- Control or process the personal data of at least 25,000 Virginia residents and derive more than 50% of their gross revenue from the sale of personal data.
Consumer rights under VCDPA
- The right to know, access and confirm personal data.
- The right to delete personal data.
- The right to correct inaccuracies in personal data.
- The right to data portability (i.e., easy, portable access to all pieces of personal data held by a company).
- The right to opt out of the processing of personal data for targeted advertising purposes.
- The right to opt out of the sale of personal data.
- The right to opt out of profiling based upon personal data.
- The right to not be discriminated against for exercising any of the foregoing rights.
VCDPA enforcement and fines
The VCDPA will be enforced by the Virginia Attorney General and allows for a 30-day cure period, but uncured non-compliance can result in a civil penalty of up to $7,500 per violation.
VDPA and Consent Collection
If your website uses cookies to collect and process personal data from individuals inside the state of Virginia, users must have the option to opt out of that personal data being used for personlized advertising.
The Virginia Consumer Data Protection Act (VDPA) Timeline
- The VDPA was signed into law in March 2021.
- The VDPA takes effect January 1, 2023.
VCDPA vs CCPA
VCDPA is more like GDPR. The VCDPA’s definition of consent is even word-for-word taken from the EU’s GDPR, requiring the “freely given, specific, informed and unambiguous agreement” to constitute a valid end-user consent.
Consent is requried to processing personal and sensitive personal data.
Other US State Privacy Laws
- CCPA: California Consumer Privacy Act, learn more at CCPA
- CPRA: California Privacy Rights Act, learn more at CPRA
- CPA: Colorado Privacy Act, learn more at CPA
- VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
- UCPA: Utah Consumer Privacy Act, learn more at UCPA
- CTDPA: Connecticut Data Protection Act, learn more at CTDPA
- COPPA: Children’s Online Privacy Protection Act, learn more at COPPA
Compare different US State Privacy Laws
How to compliant with and implement the Virginia Consumer Data Protection Act Compliance Solution?
Use a consent management platform like UniConsent to offer consumers full control of data collection, opt-out features, manage the preferences communication.
Comply With Global Privacy Regulations
Get started to make your website and application compliant for EU GDPR, US CPRA, CA PIPEDA etc
Sign up