Does Virginia have a comprehensive privacy law? Yes. The Virginia Consumer Data Protection Act, approved on March 2, 2021, has been in effect since January 1, 2023.
- Status: In Effect
- Law: Consumer Data Protection Act (SB 1392 and identical HB 2307, 2021; Acts of Assembly 2021 Special Session I, Chapter 36; Va. Code § 59.1-575 et seq.)
- Signed: March 2, 2021 · Effective: January 1, 2023
- Applies to: Persons that conduct business in Virginia or produce products or services targeted to Virginia residents and, during a calendar year, control or process the personal data of at least 100,000 consumers, or control or process the personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data
- Cure period: Yes; 30 days after the Attorney General’s written notice; no end date
- Enforcement: Attorney General (exclusive); civil penalty of up to $7,500 per violation, plus injunctions and expenses; no private right of action
- Last verified: November 4, 2026 · Official source: Virginia LIS, SB 1392 (2021)
- Related: Virginia Consumer Data Protection Act guide
Virginia’s comprehensive privacy law is the Consumer Data Protection Act (VCDPA), passed in 2021 as Senate Bill 1392 and the identical House Bill 2307. The Governor approved SB 1392 on March 2, 2021 (Chapter 36), and the law took effect on January 1, 2023. It is codified in chapter 53 of Title 59.1 of the Code of Virginia, beginning at § 59.1-575.
The VCDPA covers persons that do business in Virginia or target Virginia residents and that, in a calendar year, control or process the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Consumers can access, correct, delete and obtain a copy of their personal data, and can opt out of targeted advertising, the sale of their data and profiling. The Attorney General has exclusive enforcement authority, must give 30 days’ written notice and a chance to cure before suing, and may seek civil penalties of up to $7,500 per violation.
For a fuller explanation of the law, read our guide to the Virginia Consumer Data Protection Act.