Virginia (US)

Full entry AI-checked Checked 5 November 2026

How this was checked

Checked against the official sources below with AI assistance on 5 November 2026. Nobody has reviewed it as a lawyer, and it isn’t legal advice. Check the sources before you rely on a fact.

Read this together with United States (federal), which also applies.

Laws

Law	Citation	Status	In force from
Virginia Consumer Data Protection Act (VCDPA)	Va. Code §§ 59.1-575 to 59.1-584	In force	1 January 2023
Breach of personal information notification	Va. Code § 18.2-186.6	In force	1 July 2008
Virginia Telephone Privacy Protection Act	Va. Code § 59.1-510 et seq.	In force	1 July 2001

• Virginia Consumer Data Protection Act (VCDPA): Amended in 2024 (known children under 13), 2025 (social media time limit for under-16s from 1 January 2026, which is being challenged in court; see children) and 2026 (ban on selling precise geolocation data from 1 July 2026).
• Virginia Telephone Privacy Protection Act: Sales calls and, since a 2025 amendment, sales texts.

Regulators

• Office of the Attorney General of Virginia (Consumer Protection Section)

What builders must do

Who it covers

Applies to businesses that operate in Virginia or target its residents and, in a calendar year, control or process data of 100,000 or more consumers, or of 25,000 or more while getting over half their gross revenue from selling personal data. Government bodies, non-profits, universities, GLBA financial institutions and HIPAA covered entities are exempt. Consumers are residents acting in a personal or household role, so employees and B2B contacts aren’t covered.

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575

Lawful bases

There are no GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data, and to opt out of targeted advertising, sale and significant-decision profiling, within 45 days. Sensitive data needs opt-in consent. Since 1 July 2026 selling precise geolocation data is banned. Separately, the Consumer Protection Act bans obtaining, disclosing or selling reproductive or sexual health information without consent.

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578 · law.lis.virginia.gov/vacode/title59.1/chapter17/section59.1-200 · oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Cons…

Consent age for online services

A child is anyone under 13. A known child’s data is sensitive data and must be handled under COPPA, so a parent must consent before it’s used for targeted advertising, sale or significant profiling. The VCDPA has no teen opt-in rule for advertising or sale; a separate social media time limit covers under-16s (see children).

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578

Children

Without a parent’s COPPA consent, controllers can’t use a known child’s data for targeted ads, sale or significant profiling, process it beyond what the service needs, or collect precise geolocation (which also needs a visible signal). Services directed to known children need a data protection assessment. Since 1 January 2026, social media platforms must limit under-16s to one hour a day per service unless a parent agrees. NetChoice, a trade group of platforms, sued to block that rule; the case (4th Cir. No. 26-1252) was argued on appeal on 28 October 2026 and is undecided.

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-580 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577.1 · oag.state.va.us/media-center/news-releases/2961-attorney-general-jay-… · ca4.uscourts.gov/oral-argument/oral-argument-audio-files

Leads, not sources: storage.courtlistener.com/recap/gov.uscourts.vaed.585353/gov.uscourts… · storage.courtlistener.com/recap/gov.uscourts.vaed.585353/gov.uscourts…

Cookies and similar technologies

There’s no cookie-consent rule. Consumers can opt out of targeted advertising, and a controller that uses it must say so clearly and explain how to opt out. The VCDPA doesn’t require honouring a universal opt-out signal such as Global Privacy Control.

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577

Electronic marketing

Email marketing relies on federal CAN-SPAM. The Virginia Telephone Privacy Protection Act adds rules for sales calls and, since a 2025 amendment, sales texts. Calls and texts only between 8am and 9pm without prior consent, none to numbers on the National Do Not Call Registry, and a STOP or UNSUBSCRIBE reply must be honoured for 10 years. People can sue for $500 for a first violation, $1,000 for a second and $5,000 for each one after.

Sources: law.lis.virginia.gov/vacodefull/title59.1/chapter44

Breach notification

Tell the Attorney General and affected Virginia residents without unreasonable delay when unencrypted personal information is accessed and acquired and is believed to cause identity theft or fraud. If you notify more than 1,000 people at once, also tell the Attorney General and the nationwide credit bureaus about the notices. The Attorney General can fine up to $150,000 per breach, and people can still recover direct economic damages. Employers and payroll providers must also tell the Attorney General about breaches of income tax withholding data.

Sources: law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6

Registration and fees

The VCDPA requires no registration, fee or data broker registration.

Sources: law.lis.virginia.gov/vacodefull/title59.1/chapter53

Data protection officer

There’s no requirement to appoint a data protection officer.

Sources: law.lis.virginia.gov/vacodefull/title59.1/chapter53

International transfers

Virginia law sets no restrictions on transferring personal data abroad; federal rules are in us-federal.

Sources: law.lis.virginia.gov/vacodefull/title59.1/chapter53

Impact assessments

Document a data protection assessment for targeted advertising, sale, sensitive data, risky profiling and other heightened-risk processing, and for any online service directed to known children. The Attorney General can demand assessments in an investigation, and they stay confidential.

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-580

Automated decisions and AI

Consumers can opt out of profiling used for decisions with legal or similarly significant effects, such as on credit, housing, insurance, education, jobs, health care or basic necessities. Virginia has no general AI law. In 2026, bills on AI companion chatbots and minors didn’t pass and were sent to a legislative commission for study.

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577 · law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575 · dls.virginia.gov/commissions/jcots/Materials/2026_AI_Chatbots_Report.pdf

Penalties

The Attorney General enforces alone. Before suing it must give 30 days’ notice to cure, and this right to cure doesn’t expire. Civil penalties are up to $7,500 per violation, plus injunctions and expenses. There’s no private right of action under the VCDPA, but people can sue over the reproductive health rule under the Consumer Protection Act, for $500 or actual damages ($1,000 or triple if wilful).

Sources: law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-584 · law.lis.virginia.gov/vacode/title59.1/chapter17/section59.1-204

History

Date	Change
5 November 2026	First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review.

Report a change

If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-va.yaml.