Does VCDPA require opt-in for sensitive data?

Yes. Processing sensitive personal data in Virginia requires the consumer's opt-in consent.

Can consumers opt out of targeted advertising?

Yes, VCDPA gives a right to opt out of targeted advertising, sale and certain profiling.

Virginia, USA

VCDPA compliance with ConsentX

Virginia Consumer Data Protection Act

In short

Virginia's privacy law lets consumers opt out of targeted advertising, the sale of personal data and certain profiling, and requires opt-in consent for sensitive data.

Region

Virginia, USA

Status

In force since 2023

Group

United States

Who it applies to

Businesses that process data of 100,000+ Virginia consumers, or 25,000+ while deriving over half of revenue from selling data.

Penalties

Up to $7,500 per violation, enforced by the Virginia Attorney General.

Key obligations

Offer opt-out of targeted ads, sale and profiling
Get opt-in consent for sensitive data
Honor consumer rights requests
Provide a clear privacy notice
Recognize universal opt-out signals

How ConsentX helps

Opt-out controls for targeted ads and sale

Opt-in gating for sensitive categories

Universal opt-out / GPC handling

DSAR workflow with evidence

Get VCDPA ready with ConsentX

Start free, or book a walkthrough with our team.

Get started free Book a demo

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified counsel.

Frequently asked questions

Related on ConsentX

Free cookie scanner Check what fires on your site before consent and where you stand on VCDPA.Privacy fine calculator Estimate your maximum penalty exposure under VCDPA and other laws.

Other frameworks

GDPR UK GDPR CCPA / CPRA Colorado CPA CTDPA UCPA TDPSA Oregon OCPA Montana MCDPA Florida FDBR LGPD PIPEDA DPDPA PDPA POPIA