Virginia VCDPA
Amended Virginia · In force Jan 1, 2023 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
The second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.
- Who it applies to
- Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.
- Penalties
- Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.
- Enforced by
- Virginia Attorney General (exclusive)
- Official name
- Virginia Consumer Data Protection Act (SB 1392 / HB 2307, 2021)
- Citation
- Va. Code 59.1-575 to 59.1-585 (Acts 2021, Sp. Sess. I, ch. 35 and 36); amended 2025 (SB 854) and 2026 (SB 338)
- Topics
- privacy, children, online-safety
Research notes
SB 338 signed by Gov. Spanberger on April 13, 2026 (per Hunton, Proskauer and Consumer Reports; the LIS bill page renders via JavaScript and could not be read). SB 854's Feb 27, 2026 injunction comes from the court opinion hosted by NetChoice; Virginia's appeal to the Fourth Circuit was pending as of the latest sources found. Treat the SB 854 obligations as unenforceable while the injunction stands.
Related
Questions about Virginia VCDPA
- What are the Virginia VCDPA compliance deadlines?
- Jan 1, 2023: VCDPA takes effect. Jan 1, 2026: Under-16 social media time limit (SB 854) takes effect. Feb 27, 2026: SB 854 preliminarily enjoined (NetChoice v. Jones). Jul 1, 2026: Ban on selling precise geolocation data (SB 338).
- When does Virginia VCDPA take effect?
- Virginia VCDPA took effect on Jan 1, 2023.
- Who does Virginia VCDPA apply to?
- Persons conducting business in Virginia or targeting Virginia residents that in a calendar year control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data (59.1-576). Exempts government, GLBA financial institutions, HIPAA entities, nonprofits, higher education.
- What are the penalties under Virginia VCDPA?
- Civil penalties up to $7,500 per violation, plus injunction and AG expenses/fees (59.1-584). Mandatory 30-day notice-and-cure period; it does not sunset. No private right of action.