Virginia
Virginia Consumer Data Protection Act
Virginia’s consumer privacy law. It gives Virginia residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 1, 2023
- Citation
- Va. Code § 59.1-575 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 100,000+ Virginia residents a year, or 25,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- Don’t sell precise geolocation data (from Jul 1, 2026).
Who has to comply
The law covers businesses that operate in Virginia or target Virginians and, in a calendar year, control or process the personal data of at least 100,000 consumers, or at least 25,000 while making over 50% of gross revenue from selling personal data.
It doesn’t apply to nonprofits, higher-education institutions, government bodies, financial institutions and data under the Gramm-Leach-Bliley Act, or HIPAA covered entities and business associates.
Visitors’ rights and your deadlines
- Virginians can confirm and access their data, correct it, delete it, get a portable copy, and opt out of targeted advertising, sale and profiling.
- Respond within 45 days, extendable once by 45 more when reasonably necessary.
- Requests are free up to twice a year per person.
- Appeals: answer in writing within 60 days, and if you deny the appeal, explain how to contact the Attorney General.
Opt-out signals and “sale”
Unlike California, Colorado, Texas and others, Virginia’s law doesn’t require businesses to honor a universal opt-out signal such as Global Privacy Control. Its definition of “sale” is also narrower: an exchange of personal data for money. You still need to disclose clearly if you sell data or use it for targeted ads, and explain how to opt out.
Sensitive data, children and location
Processing sensitive data needs the consumer’s consent, a clear affirmative act. For a known child under 13, you need parental consent in line with the federal Children’s Online Privacy Protection Act. Since July 1, 2026, businesses may not sell precise geolocation data at all.
Enforcement
The Attorney General has exclusive authority to enforce the law. Before acting, the Attorney General gives 30 days’ written notice, and no action is brought if the business cures the violation in that time. Penalties are up to $7,500 per violation, and there’s no private right of action.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Virginia require honoring Global Privacy Control?
No, Virginia’s law doesn’t require universal opt-out signals. Many businesses honor GPC everywhere anyway, because California, Colorado, Texas and other states do require it.
Does the Virginia law apply to nonprofits?
No. Nonprofit organizations are exempt.
Can I sell location data from Virginians?
Not precise geolocation data. Since July 1, 2026, the law says a business may not sell it.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
