Virginia CDPA Explained: VCDPA Compliance Guide

Introduction

As data privacy regulation fragments across the United States, Virginia carved out its own distinct approach to protecting consumer data. The Virginia CDPA (Virginia Consumer Data Protection Act, often abbreviated as VCDPA) was signed into law in 2021 and became fully enforceable on January 1, 2023. By passing this legislation, Virginia became the second state, directly following California, to enact a comprehensive, overarching data privacy framework.

However, organizations expecting a simple copy-paste of California’s rules are in for a sharp awakening. The Virginia CDPA introduces a fundamentally different operational framework heavily inspired by the Washington Privacy Act (which failed to pass) and the European GDPR. It establishes rigid, affirmative duties for data controllers, explicitly distinguishes between controllers and processors, and creates a strict opt-in regime for the processing of sensitive data.

For businesses operating nationally, the VCDPA represents a critical compliance benchmark. Because its provisions regarding Data Protection Assessments and sensitive data collection are highly rigorous, many privacy engineers view Virginia’s requirements as the baseline standard for building a national privacy architecture. If an organization can satisfy the VCDPA’s structural demands, it is generally well-positioned to adapt to emerging laws in other states like Colorado and Connecticut.

Failing to meet these standards invites severe consequences. The Virginia Attorney General exercises exclusive enforcement authority and can levy fines of up to $7,500 for each individual violation. This guide breaks down the VCDPA’s core mechanisms, clarifies exactly who falls under its jurisdiction, and provides actionable checklists to ensure your data architecture remains legally compliant.

What Is the Virginia CDPA?

The Virginia CDPA (codified at Va. Code Ann. § 59.1-575 et seq.) is a statutory framework designed to give Virginia residents control over how their digital footprints are tracked, monetized, and secured. The law grants consumers the right to access the personal data a business holds on them, correct inaccuracies, delete their data, and obtain a copy of their data in a portable format.

Most importantly, the VCDPA grants consumers the right to definitively opt out of the processing of their personal data for three specific purposes: targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects concerning the consumer.

The law establishes a clear jurisdictional boundary based purely on data volume, rejecting the revenue-based thresholds seen in California. The VCDPA applies to persons that conduct business in Virginia, or produce products or services targeted to Virginia residents, and meet one of the following two thresholds during a calendar year:

1. Control or process the personal data of at least 100,000 consumers.
2. Control or process the personal data of at least 25,000 consumers and derive over 50% of their gross revenue from the sale of personal data.

A critical nuance of the VCDPA is its definition of a “consumer.” The law strictly limits this term to a natural person residing in Virginia acting only in an individual or household context. It explicitly excludes individuals acting in a commercial or employment context. This means B2B contacts, employee records, and applicant data are entirely exempt from the law, significantly reducing the compliance burden for HR and enterprise sales teams compared to California’s regulations.

The law also features broad entity-level exemptions. Financial institutions governed by the GLBA, covered entities governed by HIPAA, nonprofit organizations, and institutions of higher education are entirely exempt from the VCDPA’s requirements.

How the Virginia CDPA Works

The operational core of the VCDPA rests on the “Duties of Data Controllers.” These are affirmative legal obligations that dictate how an organization must structure its data lifecycle, moving far beyond simply updating a privacy policy.

1. Duty of Data Minimization: Organizations must restrict their collection of personal data to what is “adequate, relevant, and reasonably necessary” in relation to the purposes for which the data is processed. You cannot legally stockpile consumer data for hypothetical future analytics.
2. Duty of Purpose Limitation: Controllers must state the express purpose for collecting data. Once stated, they are legally prohibited from processing that personal data for any secondary purpose that is neither reasonably necessary to, nor compatible with, the originally disclosed purpose unless they obtain fresh consent from the consumer.
3. Duty to Secure Data: Organizations must establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.
4. Duty Regarding Sensitive Data: This is one of the VCDPA’s strictest provisions. The law prohibits organizations from processing “sensitive data” (which includes race, religious beliefs, mental/physical health diagnoses, sexual orientation, precise geolocation, genetic/biometric data, and children’s data) without obtaining the consumer’s explicit, affirmative opt-in consent prior to collection.
5. Data Protection Assessments: The VCDPA mandates that controllers conduct and document Data Protection Assessments (DPAs) before engaging in processing activities that present a heightened risk of harm. This legally requires organizations to perform a cost-benefit analysis before rolling out targeted advertising campaigns, selling data, or profiling users.

VIDEO · READY 16:9

PLAY

What You Need to Know about the Virginia Consumer Data Protection Act (from an IG perspective)

Virginia CDPA vs CCPA

While Virginia and California both champion consumer privacy, their legislative approaches create divergent technical requirements for engineering and compliance teams.

The most significant architectural difference is the handling of sensitive data. In California, you can collect sensitive data by default as long as you provide a link allowing the user to limit its use later. In Virginia, your systems must physically block the collection of sensitive data—like precise GPS coordinates—until the user actively clicks “Allow” or “Accept.”

Real-World Use Cases

The VCDPA forces organizations to embed privacy directly into their product design and vendor management workflows.

Consider a mobile application developer based in New York that creates a fitness tracking app. The app becomes wildly popular, quickly surpassing 150,000 active users in Virginia. Because the app tracks the user’s running routes, it collects precise geolocation data, which the VCDPA classifies as sensitive data. To comply with Virginia law, the developers cannot simply hide a geolocation clause in a 40-page Terms of Service agreement. They must design a user interface that explicitly asks for opt-in consent to track location before the app’s GPS module activates. If the Virginia user declines, the app must still allow them to use non-location-based features, adhering to the VCDPA’s prohibition against discriminating against consumers who exercise their rights.

In the retail sector, a national clothing brand wants to launch a highly targeted email marketing campaign using a third-party analytics vendor to profile their customers’ purchasing habits. Because the VCDPA defines profiling that produces significant effects (or targeted advertising) as a high-risk activity, the retailer’s legal and IT teams must conduct a formal Data Protection Assessment (DPA). They must document exactly what data is sent to the vendor, how the algorithm profiles the users, and what safeguards (such as Tokenization vs Encryption) are used to protect the data in transit. This DPA must be securely archived, as the Virginia Attorney General has the legal authority to demand a copy of it during an investigation.

For a B2B software provider selling enterprise resource planning (ERP) systems to Virginia corporations, the VCDPA has minimal impact. Because the VCDPA strictly exempts data processed in an employment or commercial context, the contact information of the corporate buyers, and the employee data stored within the ERP system, fall completely outside the law’s scope. The B2B provider does not need to build consumer opt-out portals for these specific datasets, saving significant engineering resources.

Common Mistakes to Avoid

A massive compliance pitfall under the VCDPA is misunderstanding the legal definition of a “sale” of personal data. Unlike California, which defines a sale broadly as exchanging data for monetary or “other valuable consideration,” Virginia defines a sale strictly as the exchange of personal data for monetary consideration by the controller to a third party. However, Virginia explicitly regulates “targeted advertising” as a separate, distinct activity that users can opt out of. Organizations often mistakenly believe that because they don’t exchange data for cold, hard cash, they don’t need an opt-out mechanism. If you use third-party tracking pixels (like Meta or Google Ads) to retarget users across the internet, you are engaging in targeted advertising, and you must provide a clear opt-out mechanism under the VCDPA.

Another severe operational failure is ignoring the Data Protection Assessment (DPA) requirement. Many companies assume that completing a generic internal security review is sufficient. The VCDPA legally mandates DPAs for specific triggers: targeted advertising, selling data, profiling, and processing sensitive data. If the Attorney General investigates a consumer complaint about your marketing practices and you cannot produce a documented DPA that predates the campaign, you are in direct violation of the statute.

Finally, organizations often fail to flow down VCDPA requirements to their vendors. The law explicitly distinguishes between data controllers (who determine the purpose of processing) and data processors (vendors who act on behalf of the controller). The VCDPA requires a binding written contract between the two parties that sets forth clear instructions for processing, requires the processor to ensure the confidentiality of the data, and mandates that the processor delete or return all data at the end of the contract. Relying on a vendor’s standard, un-negotiated Terms of Service will almost certainly fail to meet Virginia’s strict contractual requirements.

Getting Started: Compliance Checklists

To achieve compliance with the Virginia Consumer Data Protection Act, organizations must systematically operationalize the statutory duties outlined in Va. Code Ann. § 59.1-578.

Use the following HTML checklists to audit your privacy program and ensure your technical architecture meets Virginia’s rigid standards.

Data Controller Duties Checklist

These administrative obligations dictate how you structure your data collection and privacy disclosures.

1. Data Minimization Enforcement: Limit data collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes (Va. Code Ann. § 59.1-578(A)(1)).
2. Secondary Use Prohibition: Ensure technical guardrails prevent the processing of data for secondary purposes without obtaining new, affirmative consent (Va. Code Ann. § 59.1-578(A)(2)).
3. Security Safeguards: Establish, implement, and maintain reasonable administrative, technical, and physical data security practices (Va. Code Ann. § 59.1-578(A)(3)).
4. Sensitive Data Opt-In: Implement hard blockers in your UI/UX to prevent the collection or processing of sensitive data without explicit, affirmative opt-in consent (Va. Code Ann. § 59.1-578(A)(5)).
5. Privacy Notice Requirements: Publish a clear privacy notice detailing data categories, processing purposes, consumer rights mechanisms, and categories of data shared with third parties (Va. Code Ann. § 59.1-578(C)).

Technical Operations & Vendor Management Checklist

These controls ensure you can honor consumer rights and manage downstream data flows legally.

1. Subject Rights Portal: Establish a secure, accessible mechanism for consumers to invoke their rights to access, correct, delete, and port their data (Va. Code Ann. § 59.1-577(A)).
2. Targeted Advertising Opt-Out: Provide a clear, conspicuous link or mechanism allowing consumers to opt out of targeted advertising and data sales (Va. Code Ann. § 59.1-577(A)(5)).
3. Response Timelines: Implement internal SLA workflows to verify and respond to consumer rights requests within 45 days (Va. Code Ann. § 59.1-577(B)(1)).
4. Data Protection Assessments (DPAs): Formally document and archive DPAs before initiating targeted advertising, data sales, profiling, or processing sensitive data (Va. Code Ann. § 59.1-580(A)).
5. Processor Contracts (DPAs): Execute binding Data Processing Agreements with all vendors, strictly defining processing instructions, confidentiality requirements, and post-contract data deletion (Va. Code Ann. § 59.1-579(B)).

By integrating these checklists into your deployment pipelines and legal reviews, your organization can successfully navigate Virginia’s aggressive privacy framework. For insights into how other states handle similar regulations, review our guide on the Colorado Privacy Act (CPA). To understand the technical safeguards required to protect consumer data at rest, explore the fundamentals of Hardware Security Modules.