🇺🇸Virginia Consumer Data Protection Act

Skin

← Back to laws in United States

Virginia Consumer Data Protection Act

Virginia Consumer Data Protection Act

The Virginia Consumer Data Protection Act is one of the early comprehensive state consumer privacy laws in the United States. It applies to persons that conduct business in Virginia or produce products or services targeted to Virginia residents and meet specified processing or revenue thresholds. The law uses a controller and processor model and gives consumers rights over personal data.

Virginia’s law is important because it influenced several later US state privacy statutes. It focuses on consumer rights, controller duties, processor contracts, data protection assessments and Attorney General enforcement.

Scope and exemptions

The Virginia law applies where a business meets the statutory thresholds based on the number of consumers whose personal data is controlled or processed, or a lower number combined with deriving over 50 percent of gross revenue from the sale of personal data. It excludes certain entities and data, including government bodies, financial institutions or data subject to GLBA, HIPAA covered entities and business associates, nonprofits and higher education institutions.

It also excludes several specific categories of data, including protected health information, FCRA-regulated activity, FERPA-regulated data and other federally regulated information. These exemptions must be applied to the correct data or activity.

Key Provisions

Consumer rights: confirm processing, access, correction, deletion, portability and opt-out of targeted advertising, sale and certain profiling.

Controller duties: limit collection, establish reasonable security, avoid discrimination and provide a clear privacy notice.

Privacy notice: disclose categories of personal data, purposes, rights mechanisms, categories shared with third parties and categories of third parties.

Processor contracts: processing on behalf of a controller must be governed by a binding contract with specified duties.

Data protection assessments: required for certain high-risk processing activities.

Consumer rights

Virginia consumers may request confirmation of whether a controller is processing their personal data and may access that data. They may correct inaccuracies, delete personal data provided by or obtained about them, obtain a portable copy of personal data previously provided, and opt out of processing for targeted advertising, sale of personal data or profiling in furtherance of decisions that produce legal or similarly significant effects.

Known children’s rights may be exercised by a parent or legal guardian. Controllers and processors that comply with COPPA’s verifiable parental consent requirements are treated as compliant with the parental consent obligation under the Virginia law.

Controller duties and privacy notices

Controllers must provide a reasonably accessible, clear and meaningful privacy notice. The notice should identify categories of personal data processed, purposes, how consumers may exercise rights, categories of data shared with third parties and categories of third parties. If the controller sells personal data or processes data for targeted advertising, that activity and the opt-out method must be clearly and conspicuously disclosed.

Controllers must also establish secure and reliable means for consumers to submit rights requests. They should not require a consumer to create a new account to exercise rights, although use of an existing account may be allowed.

Practical risk area

Virginia’s exemptions are important but should not be overextended. A healthcare or financial organisation may have exempt regulated data and non-exempt website, marketing, analytics or consumer support data.

Processor contracts and assessments

A processor must follow the controller’s instructions and assist with consumer rights requests, security obligations, breach notification support and data protection assessments. The controller-processor contract must set out processing instructions, nature and purpose, data type, duration and the rights and obligations of both parties.

The contract should also address confidentiality, deletion or return of data, information needed to demonstrate compliance, assessments and subcontractor obligations. Data protection assessments should be documented for processing activities that create higher privacy risks.

What this means for you

If Virginia law applies, build compliance around clear notices, consumer rights intake, opt-out workflows, processor contracts and risk assessments. Start with a data map that separates Virginia-covered personal data from federally regulated or exempt data.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis