← Global Privacy Laws Research Library
Va. Code §§59.1-571 et seq.
Virginia Consumer Data Protection Act: VCDPA
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- State privacy statute
- Region
- North America
What it covers
The VCDPA regulates covered businesses that control/process personal data of Virginia consumers and establishes:
- consumer rights
- controller duties
- processor duties
- sensitive-data rules
- targeted-advertising controls
- sale opt-outs
- profiling opt-outs
- data-protection assessments
- universal opt-out mechanisms.
The current Virginia Code confirms the statutory thresholds and exemptions. (law.lis.virginia.gov)
Why it matters
Virginia was one of the first US state privacy statutes to combine a GDPR-influenced controller/processor model with specific consumer rights and a right to opt out of certain profiling.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
The principal AI intersection is profiling and automated/algorithmic processing.
The VCDPA does not constitute a general AI Act, but it can apply to AI systems used for:
- targeted advertising
- behavioural profiling
- significant consumer decisions.
Cybersecurity
HIGH
Controllers must implement reasonable administrative, technical and physical safeguards.
Applicability
The current §59.1-576 applies to persons that:
- conduct business in Virginia or target Virginia residents; and
- process at least 100,000 consumers' personal data; or
- process at least 25,000 consumers' personal data and derive over 50% of gross revenue from sale of personal data,
subject to exclusions. (law.lis.virginia.gov)
The statute contains significant exemptions for areas including certain financial institutions, HIPAA-covered information and other regulated categories.
Current validity
CURRENT: CODE VERSION CHECKED 20 SEPTEMBER 2026. (law.lis.virginia.gov)
Read first
§59.1-576 → §59.1-577 → §59.1-578 → §59.1-579 → §59.1-580 → profiling/sensitive-data provisions.
Provisions / sections covered
§59.1-577: Consumer rights
Consumers have rights including:
- confirmation/access
- correction
- deletion
- portability.
The current Code expressly confirms these rights. (law.lis.virginia.gov)
The section also provides opt-out rights relating to:
- targeted advertising
- sale of personal data
- certain profiling.
§59.1-578: Controller responsibilities
Controllers must:
- minimise collection
- limit processing to disclosed/reasonably compatible purposes
- maintain transparency
- implement security
- comply with data-subject requests.
The current provision expressly requires collection to be adequate, relevant and reasonably necessary. (law.lis.virginia.gov)
§59.1-579
Processor responsibilities.
§59.1-580: Data protection assessments
Requires assessments for specified processing presenting heightened risks.
These include activities such as:
- targeted advertising
- sale of personal data
- profiling producing significant effects
- sensitive-data processing.
Subject-matter tags
- Consent
- Erasure and deletion
- Data portability
- Profiling
- Security
- Data protection officer
- Controller and processor
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.