Law / United States / 
Virginia
Virginia Consumer Data Protection Act (VCDPA)
Va. Code Ann. §§ 59.1-575 to 59.1-584
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2023.
A personal data rule binding private bodies.
As of 29 August 2026.
What it requires
- Personal data that is lawfully made available through a government record, or that you have a reasonable basis to believe is lawfully made available to the public through widely distributed media, by the consumer, or by someone the consumer disclosed it to, falls outside VCDPA's definition of personal data, unless the consumer restricted it to a specific audience.
- Cite this Act as Va. Code Ann. §§ 59.1-575 to 59.1-584, not sections 59.1-571 to 59.1-585; section 59.1-571 is now a different, unrelated Act's definitions section.
- As of July 1, 2026, do not sell a Virginia consumer's precise geolocation data at all if you are subject to VCDPA's 2026 amendment (SB 338); this amendment's exact mechanism rests on secondary commentary only and is not independently confirmed against primary text.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
VCDPA, the first comprehensive state consumer privacy law in the country, defines personal data to exclude de-identified data and publicly available information, meaning information lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted it to a specific audience; this reaches most scraped public personal data outside VCDPA's coverage at the definitional level.
Enforcement is by the Attorney General exclusively; the Act expressly states that nothing in it shall be construed as providing the basis for, or be subject to, a private right of action. This Act is sometimes cited as sections 59.1-571 to 59.1-585, which is wrong: section 59.1-571 is currently the definitions section of the unrelated Humane and Toxin-Free Cosmetics Act (Title 59.1, Chapter 52), and section 59.1-585 is a repealed placeholder.
VCDPA's actual current codification, confirmed directly against the official Virginia Law site, runs from section 59.1-575 (Chapter 53's own definitions section) to section 59.1-584 (its enforcement section).
In 2026, the General Assembly passed and Governor Spanberger signed SB 338 (signed April 13, 2026, effective July 1, 2026, per contemporaneous legal commentary), replacing VCDPA's prior consent-based treatment of precise geolocation as sensitive data with an outright ban on selling a consumer's precise geolocation data; the enrolled text of SB 338 is not reproduced in the official code copy cited here, so its effective date and exact mechanism rest on that commentary.
When LexLint raises it
crawls_webtrains_models
Read the law
official text, Virginia Law (law.lis.virginia.gov)
the 2026 geolocation-sale amendment (SB 338) is reported by contemporaneous legal commentary and was not independently confirmed against primary bill text
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.