VCDPA: Virginia Consumer Data Protection Act (United States)
What the VCDPA covers, and what it means for your website analytics
Official name: Virginia Consumer Data Protection Act (VCDPA). In force since 1 January 2023, it gives Virginia residents rights over their personal data and sets duties for businesses that process it at scale.
See all privacy lawsAt a glance
Virginia's consumer privacy law
The VCDPA lets Virginians see, correct, delete and move their personal data, and opt out of targeted advertising, the sale of their data and profiling. Businesses need consent before processing sensitive data, and a clear privacy notice explaining what they collect.
Who it covers
Firms serving Virginians with data on 100,000+ people, or 25,000+ if mainly selling it
What it means for websites
You must offer a clear way to opt out of targeted ads and the sale of personal data
Who enforces it
The Virginia Attorney General only, after a 30-day period to fix the violation
Maximum fines
Up to $7,500 per violation
Further reading
Everything you need on this law
The VCDPA
The current text of Virginia’s Consumer Data Protection Act, Chapter 53 of the Code of Virginia.
Read the official textAttorney General’s summary
Virginia’s enforcer sets out who the law covers, consumer rights and what businesses must do.
Read the summaryVirginia Attorney General
The Consumer Protection Section, which enforces the VCDPA, with guidance and complaint forms.
Visit the Attorney GeneralThe CCPA
California’s privacy law, which also applies to businesses based on revenue alone, unlike the VCDPA.
Read our CCPA guideThe Colorado Privacy Act
Colorado’s privacy law, built on the same model as the VCDPA, plus a duty to honor universal opt-out signals.
Read our CPA guidethoughtbot
How thoughtbot sets data collection country by country, so around 1M yearly visits stay within regional rules.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
