Virginia VCDPA
Amended Virginia · In force Jan 1, 2023 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
The second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.
- Who it applies to
- Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.
- Penalties
- Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.
- Enforced by
- Virginia Attorney General (exclusive)
- Official name
- Virginia Consumer Data Protection Act (SB 1392 / HB 2307, 2021)
- Citation
- Va. Code 59.1-575 to 59.1-585 (Acts 2021, Sp. Sess. I, ch. 35 and 36); amended 2025 (SB 854) and 2026 (SB 338)
- Topics
- privacy, children, online-safety
Research notes
SB 338 signed by Gov. Spanberger on April 13, 2026 (per Hunton, Proskauer and Consumer Reports; the LIS bill page renders via JavaScript and could not be read). SB 854's Feb 27, 2026 injunction comes from the court opinion hosted by NetChoice; Virginia's appeal to the Fourth Circuit was pending as of the latest sources found. Treat the SB 854 obligations as unenforceable while the injunction stands.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)Questions about Virginia VCDPA
- What are the Virginia VCDPA compliance deadlines?
- Jan 1, 2023: VCDPA takes effect. Jan 1, 2026: Under-16 social media time limit (SB 854) takes effect. Feb 27, 2026: SB 854 preliminarily enjoined (NetChoice v. Jones). Jul 1, 2026: Ban on selling precise geolocation data (SB 338).
- When does Virginia VCDPA take effect?
- Virginia VCDPA took effect on Jan 1, 2023.
- Who does Virginia VCDPA apply to?
- Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.
- What are the penalties under Virginia VCDPA?
- Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.