Law / United States / 
Virginia
Virginia Consumer Data Protection Act, Attorney General enforcement
Va. Code Ann. §§ 59.1-583, 59.1-584
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect VCDPA violations to be enforced exclusively by the Virginia Attorney General, never by a private plaintiff.
- Cure a noticed violation and provide a written statement of cure within 30 days of Attorney General notice to avoid an enforcement action. Unlike some peer states, Virginia's cure right carries no sunset date in the statutory text.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Virginia (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf
- Guidance body
- Office of the Attorney General of Virginia
- Open questions
- After a controller has cured a noticed violation and given the Attorney General the written statement required by Va. Code § 59.1-584(B), does a later violation of the same provision count as breaching 'an express written statement' under subsection C, or must the Attorney General give a new 30-day notice before suing?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 59.1-583 lets the Attorney General issue a civil investigative demand when there is reasonable cause to believe a person has violated or is about to violate the Act, and section 59.1-584 gives the Attorney General exclusive enforcement authority with a thirty-day written notice, a cure period and a written cure statement, and civil penalties of up to $7,500 for each violation. The power to demand information is a regulator's power and names no record the controller must keep; the written cure statement is a filing and not a record kept. The two sections have no territorial clause, so the hook is empty. The assessment the Attorney General may demand is in section 59.1-580, which this row does not cite.
- Kind
- None
- As of
What this law does
The Virginia Attorney General has exclusive authority to enforce VCDPA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; this cure right carries no sunset date in the text, unlike several peer states'. The Attorney General may seek an injunction and civil penalties of up to $7,500 per violation. The chapter creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .