Virginia Consumer Data Protection Act (VCDPA)

Key definitions in VCDPA

The Virginia data privacy law introduces several critical terms that businesses and consumers need to understand, as defined in § 59.1-575 of the Code of Virginia.

• Consumer: Any Virginia resident acting in an individual or household capacity whose personal data is collected.
• Personal Data: Any information that can identify an individual, such as names, addresses, IP addresses, biometric data, and geolocation information.
• Controller: The entity that determines the purpose and means of processing personal data.
• Processor: The entity that processes personal data on behalf of a controller.
• Sensitive Data: Includes data revealing racial or ethnic origin, health data, biometric data, and geolocation information.

Who must comply with VCDPA?

‍The Virginia Consumer Data Protection Act (VCDPA) applies to entities conducting business in Virginia or targeting its residents, and that either:

• Control or process personal data of at least 100,000 consumers annually; or
• Control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

The VCDPA defines “consumers” to mean Virginia residents acting only in an individual or household capacity. It does not include Virginia residents acting in a commercial or employment capacity:‍

“Consumer” means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.

‍§ 59.1-575 of the Code of Virginia‍

VCDPA exemptions

‍The Virginia Consumer Data Protection Act (VCDPA) exempts certain entities and data types:

Entity exemptions

• Government agencies: State and local government bodies in Virginia.
• Financial institutions: Entities subject to the Gramm-Leach-Bliley Act (GLBA).
• Healthcare organizations: Covered entities and business associates under the Health Insurance Portability and Accountability Act (HIPAA).
• Nonprofit organizations: Nonprofits, including tax-exempt political groups.
• Educational institutions: Institutions of higher education.

Data exemptions

• Protected health information: Data governed by HIPAA.
• Educational records: Information regulated by the Family Educational Rights and Privacy Act (FERPA).
• Credit information: Data under the Fair Credit Reporting Act (FCRA).
• Driver information: Data regulated by the Driver's Privacy Protection Act.
• Financial Data: Information subject to the GLBA.

These exemptions are detailed in § 59.1-576 of the Code of Virginia.

Key provisions of VCDPA

In the absence of a comprehensive federal privacy law in the U.S., which currently relies on sector-specific regulations like COPPA, HIPAA, and GLBA, several states have initiated their own data protection legislation. Notably, Virginia became the second state, following California, to enact such measures with the Virginia Consumer Data Protection Act (VCDPA). 

Is VCDPA opt-in or opt-out?

The VCDPA mostly adopts a notice and opt-out choice regime, and enables consumers to opt-out of sale, targeted advertising and profiling. Virginia also provides consumers with the right to access, correct, port and delete their data. But there are some nuances to the Virginia Consumer Data Protection Act which are worth noting.

Broad definition of personal information

Like most privacy and data protection laws promulgated over the past five years, Virginia has adopted a broad definition of personal information. It is designed to cover pseudonymous personal data (e.g., IP address, Mobile Advertising ID (MAID), Hashed Email (HEM)) and identifiable personal data (e.g., email or postal address, telephone number). 

There are exemptions for “public” information and “de-identified” data. Moreover, the rules around data subject access rights do not apply to pseudonymous personal data so long as the controller is able to demonstrate that any information necessary to identify the consumer is stored separately and subject to controls that would prevent the controller from accessing the information.

Consumer choice / consent

Virginia mostly has a notice and opt-out choice regime. That means that you can process most types of data, so long as:

• There’s a privacy notice provided that describes the intended use of the data, and
• The data subject is provided with the opportunity to opt-out of certain uses of such data (e.g., profiling, sale, targeted ads)

But be careful! Virginia requires opt-in consent for the processing of “sensitive information” (see below).

Data subject access requests

A data subject access request (DSAR) is a formal request from an individual (the data subject) to a company, requesting to see a copy of their personal data stored with the company. 

The Virginia privacy law provides consumers with the right to see the data that companies have on them. Consumers then have the right to correct and/or delete that information. Consumers may also request that their personal data be provided in a form that enables the consumer to port it to a different company. 

However, the above DSAR requests do not apply to pseudonymous personal data so long as the controller adopts certain controls to ensure that it isn’t able to identify the data subject.

Sensitive data‍

The Virginia data privacy law includes an important category of data called “Sensitive Data.” Sensitive Data is modeled on “special category” data in EU data protection law. It includes personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or citizenship status; (b) genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; or (c) personal data from a known child.

Virginia requires opt-in consent prior to processing sensitive data. Collecting potentially sensitive data will likely require some adjustments to many companies’ data taxonomy and data governance ruleset.

Controller / processor / third party

The VCDPA utilizes the GDPR terms for controller (i.e., controls the means of processing) and processor (i.e., takes direction from the controller). Similar to California’s CCPA, the VCDPA uses the term “third party” to designate any entity that is NOT a consumer, controller, processor, or an affiliate of the processor or the controller.

Data governance

Like some other states, Virginia places guard rails around how companies may process data. The expectation is for companies to only collect data that is absolutely necessary (“data minimization”) and to store it for as little time as possible (“data retention”).

Privacy assessment

Virginia requires companies that engage in certain types of processing activities (e.g., sales, certain profiling, targeted ads, use of sensitive data) to complete Privacy Assessments (PAs): systematic evaluations of their data collection and use practices with an eye towards identifying risks and minimizing or eliminating those risks.

Data processing agreements

The VCDPA suggests a data processing agreement (DPA) between controllers and processors. The purpose of a DPA is to outline how the parties plan to ensure that their intra-party data transfers are compliant with privacy laws, and to specify the permitted uses of the data.

The price of non-compliance

While GDPR ushered in a new era of large privacy and compliance fines, a few of the U.S. State Privacy Laws also incorporated some fairly aggressive fine structures. The first CCPA fine was $1.2 million. 

Fines are often determined by the number of violations–which is often dependent on the number of records in your database. Needless to say, those numbers can add up quickly if you’re working with millions of consumers in one of the states–and the fines typically don’t include legal fees or injunctive relief.

‍

‍

‍

VCDPA fines

The Virginia Consumer Data Protection Act (VCDPA) is enforced by the Virginia Attorney General. Upon identifying a potential violation, the Attorney General must provide a 30-day written notice to the offending party, specifying the provisions violated. If the violation is not remedied within this period, the Attorney General can initiate legal action seeking injunctive relief and impose civil penalties of up to $7,500 per violation. 

It's important to note that the VCDPA does not grant consumers a private right of action; enforcement authority rests solely with the Attorney General. 

Therefore failure to comply with the VCDPA can result in:

• Fines of up to $7,500 per violation.
• Legal actions and enforcement by the Virginia Attorney General.
• Required corrective actions to address compliance failures.

‍

‍

The impact of VCDPA on consumers

The Virginia data privacy law significantly enhances consumer privacy rights for Virginia residents. Under the Virginia privacy law, consumers are empowered to:

• Access: Confirm whether a business is processing their personal data and obtain access to that data.
• Correct: Rectify inaccuracies in their personal data held by businesses.
• Delete: Request the deletion of personal data provided by or obtained about them.
• Data portability: Obtain a copy of their personal data in a portable and readily usable format.
• Opt-out: Decline the processing of their personal data for purposes such as targeted advertising, the sale of personal data, or profiling.

How VCDPA compares to other U.S. data privacy laws

‍The Virginia Consumer Data Protection Act is similar in many respects to recent privacy laws passed in California, Connecticut, Colorado, Nevada, and Utah.

What these U.S. state laws have in common is the implementation of a notice and opt-out choice regime.

A “notice and opt-out choice regime” means that business can process most types of data as long as there is a consumer-facing privacy notice that describes the intended use of data, and the consumer (data subject) is provided with the opportunity to opt-out of certain uses of such data (e.g., profiling, sale, targeted ads).

VCDPA vs other state privacy laws

‍

‍

What makes VCDPA stand out?

The Virginia Consumer Data Protection Act (VCDPA) is similar to many U.S. state laws, and the following characteristics make it an important consideration for privacy program owners: 

• Controller-Processor Framework: The VCDPA adopts a model similar to the EU's General Data Protection Regulation (GDPR), clearly distinguishing between "controllers" (entities determining the purpose and means of processing personal data) and "processors" (entities processing data on behalf of controllers), with specific obligations outlined for each.
• Opt-In Consent for Sensitive Data: The Virginia data privacy law requires businesses to obtain explicit consent from consumers before processing sensitive personal data, such as information related to racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, or precise geolocation.
• Data Protection Assessments: The Act mandates that controllers conduct data protection assessments for processing activities that present a heightened risk of harm to consumers, including targeted advertising, the sale of personal data, and certain types of profiling.

How to ensure VCDPA compliance

If you’ve read this far, you know that building a privacy-compliant business is important, but also far from easy. Here are eight key steps every business should take to ensure they don’t fall foul of regulators:

What is VCDPA compliance?

VCDPA compliance involves businesses implementing measures to protect consumer data, such as conducting data protection assessments, obtaining explicit consent for processing sensitive data, and providing clear privacy notices. Compliance ensures adherence to the Virginia Consumer Data Protection Act's requirements. 

How to comply with VCDPA

To comply with VCDPA, you must:

1. Focus on the scope of the privacy notice(s) presented to data subjects

As noted above, the VCDPA generally operates under a notice and opt-out choice privacy regime. Although the VCDPA ruleset does not focus directly on secondary use of data, it’s nonetheless really important to provide clear and detailed privacy notices.

2. Label your data 

The only way to manage data governance across a full data ecosystem is to individually label every single bit of data you collect, effectively creating a layer of metadata that articulates how any given fact or unit of information can be used [APC1].

For instance, Ketch can automatically crawl and scan your data ecosystem to create and maintain that classification of data labeling metadata so that you can understand, and act on data that’s within the scope of the Virginia privacy regulation.

3. Stay flexible

Your data labels can’t be written in permanent ink. Instead, they need to reflect the rules under which the data subject is operating (which may be subject to change). For that reason, it’s important that your systems are nimble and flexible enough to allow users to change their minds and revoke or modify permissions at any moment.

4. Tell your partners

Data labels can’t be anchored in your own internal data-handling processes; instead, they need to be incorporated into the data itself. That’s vital because it’s the only way to ensure that changes made by your users will propagate out to your outside partners, and define their data-handling processes too.

5. Stay up to date

Rules change, and new privacy rules are being written all the time. By encoding compliance metadata directly into your data, you can ensure that your datasets can quickly be brought into compliance not just with Virginia Consumer Data Protection Act as they exist today, but with any new iterations or copycat statutes introduced by other states.

6. Engage a qualified legal or privacy professional

Unlike GDPR, the VCDPA does not require the appointment of a data protection or privacy officer with a legally mandated set of responsibilities.

Regardless, it’s still a good idea to have an internal person or team dedicated to ensuring privacy compliance. And bringing in an outside resource such as a privacy lawyer can help you make sure you understand all of your compliance obligations.

7. Document everything

Keeping clear records about how you’re handling data is vital when it comes to communicating with users and regulators.

How Ketch can simplify VCDPA compliance

With the Ketch Data Permissioning Platform, you can:

• Use our “clicks-not-code” interface to create policies for how data is handled throughout your data ecosystem, leveraging our templates for Virginia-specific compliance
• Create customized, jurisdictionally-aware privacy notices for your customers
• Deploy Ketch data mapping and discovery tools to find and classify sensitive and personal data in every internal and external system
• Assign data processing purposes (like analytics or targeted advertising) and permissions to data, so you know exactly how your data may be used, sold, and/or shared
• Use our drag-and-drop DSR workflow tool to create automated, end-to-end DSR fulfillment processes that replace internal stakeholder tasks with automated execution of access and deletion requests 

‍

‍When you automate these processes, you enable your internal stakeholders: 

• Your developers and marketers can do their jobs without fretting about regulations
• Your legal team can set guidelines for notice and consent, secure in the knowledge that any changes they make will ripple through your whole data ecosystem (including vendors or third-party companies using your data!)

Examples of successful VCDPA compliance

Gabe’s Stores

‍Gabe's, a leading off-price retailer, prioritized compliance with the Virginia data privacy law ahead of its January 1, 2023, enforcement date. Partnering with Ketch, they implemented a comprehensive data privacy management solution that included:

• Consent management: Customized privacy notices aligned with brand experience.
• Data subject rights (DSR) automation: Automated processes for consumer data requests, ensuring timely responses.
• Tag orchestration: Integrated consumer data preferences with website tags to respect user choices.

This collaboration not only ensured VCDPA compliance but also prepared Gabe's for future data privacy challenges, providing a scalable and flexible platform as regulations evolve. 

Ketch implementation was easy and quick. Today we’re set up not only for VCDPA compliance, but for future data privacy challenges. As data privacy regulations change, Ketch gives us a flexible platform for scaling our reach.

–Tim Rounds, Senior Director, Legal, Gabe’s

Final thoughts: Preparing your business for VCDPA

VCDPA compliance requires businesses to adopt a proactive approach to data privacy by implementing robust data management practices, ensuring transparency, and staying informed about evolving regulatory requirements.

Contact Ketch today to streamline your compliance and future-proof your privacy strategy. 

Read further: 2025 U.S. State Privacy Laws: what you need to know

FAQ