The Virginia Consumer Data Protection Act (VCDPA) is Virginia's comprehensive consumer privacy law. It establishes rights for Virginia consumers and obligations for businesses that control or process personal data.

Who needs to comply with the VCDPA?

The VCDPA generally applies to businesses conducting business in Virginia or targeting Virginia residents that meet the Act's applicable thresholds for controlling or processing personal data.

Does the VCDPA require consent?

Consent is required for certain processing activities, particularly the processing of sensitive data. However, not all processing under the VCDPA requires consent. Organizations should determine the appropriate legal basis and applicable requirements for each processing activity.

What is sensitive data under the VCDPA?

Sensitive data includes certain categories of personal data such as precise geolocation data, racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for unique identification, and certain children's data.

Does the VCDPA regulate targeted advertising?

Yes. Virginia consumers have the right to opt out of the processing of personal data for purposes of targeted advertising. ConsentX can help organizations provide privacy preference controls and implement applicable opt-out choices across their websites.

Does the VCDPA regulate the sale of personal data?

Yes. Consumers have the right to opt out of the sale of their personal data. Organizations should provide an appropriate mechanism for exercising this right and maintain processes for honoring applicable requests.

Does the VCDPA regulate profiling?

The VCDPA provides consumers with a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Does the VCDPA apply to cookies?

The VCDPA regulates personal data processing rather than cookies specifically. Where cookies, trackers or similar technologies collect or process information that qualifies as personal data, organizations should evaluate the applicable VCDPA requirements and implement appropriate privacy controls.

Does the VCDPA recognize Global Privacy Control?

Virginia's privacy framework includes requirements relating to consumer opt-out preferences. Organizations should assess applicable technical mechanisms and regulatory requirements when implementing browser-based universal opt-out signals. ConsentX supports Global Privacy Control (GPC) to help organizations operationalize applicable privacy preferences.

Does the VCDPA provide a right to appeal?

Yes. Where a controller declines to take action on a consumer request, the consumer may have a right to appeal the decision. Controllers must establish a process for responding to appeals as required by the Act. ConsentX can help organizations track consumer requests, decisions and appeals through structured workflows.

Virginia, United States

VCDPA Compliance with ConsentX

Simplify VCDPA Consent & Privacy Management

ConsentX helps organizations operationalize the Virginia Consumer Data Protection Act (VCDPA) with consent management, privacy preference controls, tracker discovery, opt-out management, consumer rights workflows and audit-ready consent records.

The VCDPA establishes privacy rights for Virginia consumers and obligations for businesses that control or process personal data. ConsentX helps organizations provide transparent privacy choices, manage consumer preferences and maintain evidence of privacy decisions across digital experiences.

Region

Virginia, United States

Status

In force

Group

United States

Who it applies to

The VCDPA generally applies to persons conducting business in Virginia or producing products or services targeted to Virginia residents that meet specified thresholds for controlling or processing personal data.

The Act contains exemptions and does not apply to every organization or type of data.

Key obligations

Provide clear privacy notices
Limit personal data collection to reasonably necessary purposes
Specify the purposes for processing personal data
Obtain consent for processing sensitive data
Provide consumer access rights
Provide correction rights
Provide deletion rights
Support data portability
Provide opt-out rights
Honor opt-outs from targeted advertising
Honor opt-outs from certain profiling activities
Provide an appeal mechanism for certain consumer requests
Maintain reasonable data security practices

How ConsentX helps

Global Privacy Control

ConsentX supports Global Privacy Control (GPC) signals, helping organizations recognize applicable browser-based privacy preferences and incorporate them into their privacy controls where required.

Prior-Script Blocking

Prevent configured non-essential cookies, trackers and scripts from firing before the applicable privacy preference or consent decision has been established.

Transparent Consent Management

Create clear consent experiences that explain how personal data may be collected and used.

Sensitive Data Consent

The VCDPA requires consent before processing certain categories of sensitive data.

Tracker & Technology Discovery

Use xScan-AI to discover cookies, trackers, scripts and third-party technologies operating across your website.

Geo-Aware Compliance

Apply Virginia-specific privacy rules while managing multiple U.S. state privacy laws and global regulations from a single platform.

Opt-Out Management

The VCDPA provides consumers with rights to opt out of certain processing activities, including targeted advertising, the sale of personal data and certain profiling activities.

Consent Records & Audit Evidence

Maintain an evidence trail of privacy choices and consent activity, including:

Consumer Rights Management

The VCDPA provides Virginia consumers with rights relating to their personal data, including access, correction, deletion, portability and certain opt-out rights.

Purpose-Based Privacy Choices

Create granular privacy categories for activities such as:

Disclaimer: This page is a plain-English summary for general informational purposes and is not legal advice. VCDPA requirements can vary depending on an organization's activities, data processing, exemptions and applicable law. Organizations should obtain appropriate legal or privacy advice for their specific obligations.

VCDPA Compliance, Made Practical

DiscoverNotifyCapture ConsentOpt OutEnforceRecordRespond

ConsentX brings consent management, privacy preferences, technology discovery and consumer-rights workflows together in one platform.

Give privacy, legal, marketing and technology teams greater visibility and control over how consumer privacy choices are implemented across digital experiences.

Start Free Book a Demo

Frequently asked questions

Virginia consumers may have rights to confirm whether a controller is processing their personal data, access their personal data, correct inaccuracies, delete personal data, obtain a copy of personal data in a portable format, opt out of targeted advertising, opt out of the sale of personal data and opt out of certain profiling activities. These rights are subject to applicable conditions and exceptions.

ConsentX provides technology that can support important VCDPA privacy operations, including consent management, sensitive-data consent, opt-out preferences, GPC support, tracker discovery, prior-script blocking, consumer-rights workflows and consent evidence. However, ConsentX alone does not guarantee VCDPA compliance. Organizations must assess their data-processing activities, privacy notices, contracts, security controls, policies and other applicable legal obligations.