Virginia Consumer Data Protection Act (VCDPA), general applicability and controller/processor duties

Va. Code Ann. §§ 59.1-575, 59.1-576, 59.1-578, 59.1-579

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2023.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

Confirm you conduct business in Virginia, or produce a product or service used by Virginia residents, and process or sell personal data before relying on VCDPA's scope in compliance planning.
Obtain a Virginia consumer's opt-in consent before processing sensitive data, and treat information a consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
Do not sell precise geolocation data collected from Virginia residents. A 2026 amendment added an outright ban on that sale.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

VCDPA governs private-sector processing of Virginia residents' personal data. Enacted in the 2021 Special Session I (cc. 35, 36), effective January 1, 2023. Controllers need a lawful basis for processing outside disclosed purposes and opt-in consent for sensitive data; controller duties are allocated at section 59.1-578 and processor duties, including a required data-processing contract, at section 59.1-579.

A 2026 amendment (S.B. 338, Ch. 820) added a ban on the sale of precise geolocation data, effective July 1, 2026 and already reflected in the codified text.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official Virginia statute text, Title 59.1 Chapter 53, Code of Virginia

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app