What are the Virginia VCDPA compliance deadlines?

Jan 1, 2023: VCDPA takes effect. Jan 1, 2026: Under-16 social media time limit (SB 854) takes effect. Feb 27, 2026: SB 854 preliminarily enjoined (NetChoice v. Jones). Jul 1, 2026: Ban on selling precise geolocation data (SB 338).

When does Virginia VCDPA take effect?

Virginia VCDPA took effect on Jan 1, 2023.

Who does Virginia VCDPA apply to?

Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.

What are the penalties under Virginia VCDPA?

Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.

Virginia VCDPA

Amended Virginia · In force Jan 1, 2023 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Takes effectJul 1 · 4 months ago · Source

Ban on selling precise geolocation data (SB 338)Controllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.

MilestoneFeb 27 · 8 months ago · Source

SB 854 preliminarily enjoined (NetChoice v. Jones)E.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed.

Takes effectJan 1 · 10 months ago · Source

Under-16 social media time limit (SB 854) takes effectSocial media platforms must use commercially reasonable age determination and cap users under 16 at 1 hour/day unless a parent consents. A preliminary injunction issued Feb 27, 2026 bars enforcement.

Takes effectJan 1, 2023 · 3.8 years ago · Source

VCDPA takes effectVCDPA obligations and consumer rights apply.

Summaries for reference, not legal advice. Check the official text.

What it does

The second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.

Who it applies to: Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.
Penalties: Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.
Enforced by: Virginia Attorney General (exclusive)
Official name: Virginia Consumer Data Protection Act (SB 1392 / HB 2307, 2021)
Citation: Va. Code 59.1-575 to 59.1-585 (Acts 2021, Sp. Sess. I, ch. 35 and 36); amended 2025 (SB 854) and 2026 (SB 338)
Topics: Privacy, Children, Online safety

Verified 2026-09-22 law.lis.virginia.gov law.lis.virginia.gov netchoice.org hunton.com hunton.com

Research notes

SB 338 signed by Gov. Spanberger on April 13, 2026 (per Hunton, Proskauer and Consumer Reports; the LIS bill page renders via JavaScript and could not be read). SB 854's Feb 27, 2026 injunction comes from the court opinion hosted by NetChoice; Virginia's appeal to the Fourth Circuit was pending as of the latest sources found. Treat the SB 854 obligations as unenforceable while the injunction stands.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months

EnactedCalifornia

California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months

In forceCalifornia

California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months

In forceCalifornia

California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months

Questions about Virginia VCDPA

What are the Virginia VCDPA compliance deadlines?: Jan 1, 2023: VCDPA takes effect. Jan 1, 2026: Under-16 social media time limit (SB 854) takes effect. Feb 27, 2026: SB 854 preliminarily enjoined (NetChoice v. Jones). Jul 1, 2026: Ban on selling precise geolocation data (SB 338).
When does Virginia VCDPA take effect?: Virginia VCDPA took effect on Jan 1, 2023.
Who does Virginia VCDPA apply to?: Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.
What are the penalties under Virginia VCDPA?: Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.

Deadlines

What it does

Related