Overview
The Virginia Consumer Data Protection Act (CDPA) is a comprehensive state privacy law that regulates how businesses collect, process, and share personal data of Virginia residents. Enacted in March 2021 and effective January 1, 2023, the CDPA grants consumers new rights over their data and imposes obligations on businesses to improve data security and transparency.
The law is modeled after the EU’s GDPR and California’s CPRA, making Virginia one of the first U.S. states to adopt broad privacy protections.
Who Must Comply?
The CDPA applies to companies that do business in Virginia or target Virginia residents and meet one of the following criteria:
✔ Process personal data of at least 100,000 consumers per year
✔ Process data of at least 25,000 consumers and derive 50%+ of revenue from data sales
Exemptions:
The law does not apply to:
🚫 Government agencies
🚫 Nonprofits
🚫 Entities covered under GLBA (financial institutions)
🚫 HIPAA-regulated entities (healthcare providers)
Key Consumer Rights Under CDPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request correction of inaccurate personal data.
✔ Right to Delete – Consumers can ask businesses to delete their data.
✔ Right to Data Portability – Consumers can obtain their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Data sales
- Certain types of profiling
Business Compliance Requirements
✔ Conduct Data Protection Assessments (DPA) – Businesses must evaluate data processing risks.
✔ Obtain Consent for Sensitive Data – Explicit consent is needed for processing sensitive data, such as:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Health data
📌 Biometric data
📌 Children’s data
✔ Privacy Notices – Businesses must publish clear privacy policies about data collection and usage.
✔ Data Minimization – Companies cannot collect more data than necessary for business purposes.
✔ Secure Personal Data – Businesses must use reasonable security measures to protect data from breaches.
Real-World Enforcement Cases
Virginia’s Attorney General enforces the CDPA, with penalties up to $7,500 per violation. While no major cases have been reported yet, enforcement is expected to increase in 2025, particularly for adtech companies and data brokers.
📌 Comparison with CPRA (California Privacy Rights Act)
The Virginia CDPA is more business-friendly than California’s CPRA:
✅ No Private Right of Action – Consumers cannot sue companies directly.
✅ Stronger Exemptions – More businesses are excluded from compliance.
✅ Opt-Out Model – Unlike GDPR, businesses don’t need prior consent to collect data (except for sensitive data).
Future of CDPA Regulation
With increased state privacy laws across the U.S., Virginia may introduce:
📌 Expanded enforcement powers for the Attorney General
📌 Stricter opt-in consent requirements for behavioral advertising
📌 More consumer rights for automated decision-makingThe CDPA serves as a model for many upcoming U.S. state privacy laws and is expected to evolve alongside federal privacy initiatives.
