Virginia Consumer Data Protection Act: Your Rights

Virginians can access, correct, delete and copy their data and opt out of sales, targeted ads and profiling.

By Siddharth ShankarUpdated October 23, 2026

Virginia was among the first US states to pass a broad consumer privacy statute. This guide follows the Virginia Attorney General’s own summary, which calls it the VCDPA.

When the law took effect and what it covers

The VCDPA took effect on January 1, 2023. It covers any information that is linked or reasonably linkable to a Virginia resident. Publicly available information, such as public records, is excluded. Protected health information under HIPAA, health records and other categories listed in the Virginia Code are also exempt.

Which businesses must comply

The Act applies to businesses that target Virginia consumers and either control or process data of at least 100,000 consumers, or control or process data of at least 25,000 consumers and earn more than 50 percent of gross revenue from selling personal data. State and local governments, nonprofits, institutions of higher education and others listed in the Code are excluded.

Your rights

You can ask a business to:

• confirm whether it is processing your data;
• correct inaccuracies;
• delete your data;
• give you a copy of your data;
• stop using your data for targeted advertising, sales or profiling.

How fast a business must respond

Replies are due within 45 days, and a business may take one extra 45-day period. You can make free requests up to twice every year.

Appeals

If a business denies your request, it must explain how to appeal. It must answer an appeal in writing within 60 days. If the appeal is denied, the business must give you a way to file a complaint with the Attorney General.

Sensitive data needs consent

A business needs your consent before processing sensitive data. The attorney general’s summary lists:

• racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, or citizenship or immigration status;
• genetic or biometric data used to uniquely identify a person;
• data from a known child under 13;
• precise geolocation.

Enforcement and penalties

Only the Attorney General can enforce the VCDPA. After written notice, a business has 30 days to fix the problem. If it does not, the Attorney General can bring a lawsuit and ask for up to $7,500 for every violation. Individuals cannot bring their own claims.

How to use your rights

1. Find the privacy notice on the business’s website and look for a request form or email address.
2. State your request clearly. Say you are a Virginia resident and which right you are using.
3. Keep a record of the date, what you asked for and any reply.
4. Follow up after 45 days if you have not had a response.
5. Appeal a denial using the process the business must explain, and complain to the Attorney General if the appeal fails.
6. Remember the limits. The Act does not cover public records or data held by exempt organisations, and it will not remove information from sources outside its scope.

Using it against data brokers

Data brokers and people search sites often process personal data. Where they are covered, you can ask them to delete your data or opt you out. Read how to opt out of data brokers yourself and what data brokers are.

Compare with other states

Other states have similar laws with different thresholds and details. See Texas, Colorado and Connecticut. California’s law is covered in how to send a CCPA deletion request.