Key Facts
Overview
The VCDPA was the second US state comprehensive privacy law and became the template that most subsequent state laws followed. It established the opt-out model with opt-in for sensitive data that has become the standard US approach. A permanent 30-day cure period distinguishes it from newer laws.
What This Means for Your Website
- A clear privacy notice is required for Virginia visitors
- Opt-in consent is needed before processing sensitive data
- Consumers can access, correct, delete, and port their data, and opt out of targeted advertising
- Data protection assessments are required for targeted advertising and profiling
- A 30-day cure period applies before enforcement action (permanent, does not sunset)
- Under-13 data is classified as sensitive, requiring opt-in consent
Key Requirements
The Virginia AG enforces the VCDPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days (extendable by 45). The permanent 30-day cure period provides businesses with a window to fix violations before penalties. SB 361 (2025) added social media restrictions for minors.
How ConsentStack Handles This
ConsentStack detects Virginia visitors and applies the VCDPA opt-out model with opt-in for sensitive data categories. Consumer opt-out preferences are recorded and respected.
Penalties
Up to $7,500 per violation.
Key Requirements
- Clear and meaningful privacy notice
- Opt-in consent before processing sensitive data
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments for targeted advertising and profiling
- 45-day response window for consumer requests
- Data minimization obligations
Notable Provisions
- Template for most subsequent US state privacy laws
- Permanent 30-day cure period
- SB 361 (2025) adds social media restrictions for minors
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, free of charge up to twice a year.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you.
Where processing is automated, obtain a copy of the personal data you previously provided in a portable and, where technically feasible, readily usable format you can transmit to another controller.
Opt out of the processing of your personal data for targeted advertising, meaning ads selected from your activity over time across nonaffiliated websites or apps.
Opt out of the sale of your personal data, meaning its exchange for monetary consideration by the controller to a third party.
Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions about lending, housing, insurance, education, criminal justice, employment, health care or basic necessities.
Appeal a controller's refusal to act on your request, within a reasonable period after you receive the decision, through a process that is conspicuously available and similar to the request process.
If your appeal is denied, the controller must give you an online mechanism, if available, or another method to contact the Virginia Attorney General and submit a complaint.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services, charging different prices or providing a different quality, though bona fide loyalty, rewards, premium features, discount or club card programs are allowed.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with VCDPA
ConsentStack helps you implement Opt-out consent for Virginia, United States automatically.