Virginia wrote the compromise that became the American default: GDPR’s vocabulary (controllers, processors, assessments) with business-calming edits, monetary-only “sale,” entity-level exemptions, a permanent cure period, and no private right of action. A dozen states copied it nearly clause-for-clause, which gives VCDPA compliance outsized leverage: build here, adjust for Colorado’s stricter rules, and the lineage states mostly inherit.
| Law | VCDPA, Va. Code 59.1-575 et seq. |
|---|---|
| Effective | January 1, 2023 |
| Max penalty | $7,500 per violation; permanent 30-day cure |
| Regulator | Virginia AG |
| Statute | Va. Code 59.1-575 et seq. |
Compliance essentials
Rights handling on the Virginia clock. 45 days to respond (one 45-day extension), free twice annually per consumer, with a mandatory appeal process: denials must offer an internal appeal, and appeal denials must point consumers to the AG’s complaint portal, a distinctive VCDPA artifact most multistate DSAR platforms now template. See the unified intake guide.
Opt-out surface without UOOM. Targeted advertising, sale, and profiling opt-outs must be offered, but Virginia never mandated universal signals. Most controllers honor GPC anyway for the states that do; treating Virginia as the floor and Colorado as the spec avoids gating logic.
Consent for sensitive data. The opt-in duty arrived before most companies’ consent tooling did; health inference, precise location, and biometric identifiers are the usual unlicensed processing found in audits. Note the 1,750-foot geolocation radius (California uses 1,850 feet), an SDK-level configuration detail.
Processor contracts. Va. Code 59.1-579 requires processing contracts with confidentiality, deletion/return, sub-processor flow-down, and audit cooperation terms, GDPR Article 28’s shape, satisfiable by the same DPA that papers CCPA service providers.
Assessments filed nowhere, ready always. Unlike California’s submission regime, Virginia assessments live in your drawer until a civil investigative demand; the state assessment matrix shows how one document serves all.
For where Virginia sits against its stricter siblings, Colorado, Connecticut, Texas, see the state comparison. And check the observable basics, trackers, targeted-ad flows, notice accuracy, with a free scan.