# Virginia — US state consumer data privacy laws: applicability thresholds by state

For Virginia, law name and abbreviation is Virginia Consumer Data Protection Act (VCDPA); effective date is January 1, 2023; consumer volume threshold is control or process personal data of at least 100,000 consumers; revenue-from-data-sales threshold is control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data; threshold combination logic is OR — applies to persons that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data, recorded from its source on 2026-08-12.

- **State:** Virginia _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Virginia Consumer Data Protection Act (VCDPA)
- **Effective date:** January 1, 2023
- **Consumer volume threshold:** control or process personal data of at least 100,000 consumers _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — applies to persons that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data _(verified: appears in the quote below)_
- **Key exemptions:** State and local government bodies; financial institutions or data subject to GLBA; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; employment data and emergency contact information
- **Enforcement mechanism:** Attorney General has exclusive authority to enforce; 30-day cure period; civil penalties up to $7,500 per violation; no private right of action
- **Statute citation:** Va. Code Ann. §§ 59.1-575 to 59.1-585
- **Notes:** Virginia's law set the template for many subsequent state privacy laws (the 'Virginia model'). No independent revenue threshold — a business with over $150 million in annual revenue is not in scope unless it also meets the consumer volume thresholds. B2B contacts and employees are excluded from consumer counts per the exemption in § 59.1-576(C)(14).

## What the source says

> This chapter applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.

## Source

- https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).