Virginia
For Virginia, law name and abbreviation is Virginia Consumer Data Protection Act (VCDPA); effective date is January 1, 2023; consumer volume threshold is control or process personal data of at least 100,000 consumers; revenue-from-data-sales threshold is control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data; threshold combination logic is OR — applies to persons that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data, recorded from its source on 2026-08-12.
- State
- Virginia our reading
- Law name and abbreviation
- Virginia Consumer Data Protection Act (VCDPA)
- Effective date
- January 1, 2023
- Consumer volume threshold
- control or process personal data of at least 100,000 consumers verified
- Revenue-from-data-sales threshold
- control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data verified
- Threshold combination logic
- OR — applies to persons that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data verified
- Key exemptions
- State and local government bodies; financial institutions or data subject to GLBA; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; employment data and emergency contact information
- Enforcement mechanism
- Attorney General has exclusive authority to enforce; 30-day cure period; civil penalties up to $7,500 per violation; no private right of action
- Statute citation
- Va. Code Ann. §§ 59.1-575 to 59.1-585
- Notes
- Virginia's law set the template for many subsequent state privacy laws (the 'Virginia model'). No independent revenue threshold — a business with over $150 million in annual revenue is not in scope unless it also meets the consumer volume thresholds. B2B contacts and employees are excluded from consumer counts per the exemption in § 59.1-576(C)(14).
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
This chapter applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.
— law.lis.virginia.gov, retrieved 2026-08-12
Source
- law.lis.virginia.govhttps://law.lis.virginia.gov/vacodefull/title59.1/chapter53/