Law / United States / 
Virginia
Virginia Consumer Data Protection Act (VCDPA)
Va. Code Ann. §§ 59.1-575 to 59.1-584
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator, Independent third party
- Where the report goes
- Produced on request
What it requires
- Personal data that is lawfully made available through a government record, or that you have a reasonable basis to believe is lawfully made available to the public through widely distributed media, by the consumer, or by someone the consumer disclosed it to, falls outside VCDPA's definition of personal data, unless the consumer restricted it to a specific audience.
- Cite this Act as Va. Code Ann. §§ 59.1-575 to 59.1-584, not sections 59.1-571 to 59.1-585; section 59.1-571 is now a different, unrelated Act's definitions section.
- As of , do not sell a Virginia consumer's precise geolocation data at all if you are subject to VCDPA's 2026 amendment (SB 338); this amendment's exact mechanism rests on secondary commentary only and is not independently confirmed against primary text.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What gives a business "a reasonable basis to believe" that information "is lawfully made available to the general public through widely distributed media" under Virginia Code section 59.1-575?
- Does a consumer who posts information where only logged-in users or followers can see it fall within "unless the consumer has restricted the information to a specific audience" under Virginia Code section 59.1-575?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment that identifies and weighs the benefits of the processing to the controller, the consumer, other stakeholders and the public against the risks to the consumer, as mitigated by safeguards (59.1-580(C)). The Attorney General may call for any assessment relevant to an investigation by civil investigative demand, and assessments are confidential and exempt from public inspection (59.1-580(D)). Section 59.1-579(B) has the controller-processor contract require the processor to make available the information needed to show its compliance and either to allow the controller's assessments or to arrange a qualified independent assessor whose report goes to the controller on request. Section 59.1-577(B)(5) lets a controller meet a deletion request for data it obtained from another source by retaining a record of the request, which is an option and not a duty. No period for keeping an assessment is stated, so no retention is recorded. The scope section, 59.1-576(A), states the hook.
- Kind
- Explicit
- As of
- Provision
- Va. Code Ann. 59.1-580(A) and (D) (a controller conducts and documents a data protection assessment of targeted advertising, sale of personal data, profiling that presents a foreseeable risk of injury, sensitive data processing and other heightened-risk processing, and makes the assessment available to the Attorney General on a civil investigative demand)
- Trigger
- personal_data_processing
What this law does
VCDPA, the first comprehensive state consumer privacy law in the country, defines personal data to exclude de-identified data and publicly available information, meaning information lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted it to a specific audience; this reaches most scraped public personal data outside VCDPA's coverage at the definitional level.
Enforcement is by the Attorney General exclusively; the Act expressly states that nothing in it shall be construed as providing the basis for, or be subject to, a private right of action. This Act is sometimes cited as sections 59.1-571 to 59.1-585, which is wrong: section 59.1-571 is currently the definitions section of the unrelated Humane and Toxin-Free Cosmetics Act (Title 59.1, Chapter 52), and section 59.1-585 is a repealed placeholder.
VCDPA's actual current codification, confirmed directly against the official Virginia Law site, runs from section 59.1-575 (Chapter 53's own definitions section) to section 59.1-584 (its enforcement section).
In 2026, the General Assembly passed and Governor Spanberger signed SB 338 (signed , effective , per contemporaneous legal commentary), replacing VCDPA's prior consent-based treatment of precise geolocation as sensitive data with an outright ban on selling a consumer's precise geolocation data; the enrolled text of SB 338 is not reproduced in the official code copy cited here, so its effective date and exact mechanism rest on that commentary.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .