Law note · Virginia
Virginia Consumer Data Protection Act (VCDPA), general applicability and controller/processor duties
VCDPA governs private-sector processing of Virginia residents' personal data. Enacted in the 2021 Special Session I (cc. 35, 36), effective January 1, 2023. Controllers need a lawful basis for processing outside disclosed purposes and opt-in consent for sensitive data; controller duties are allocated at section 59.1-578 and processor duties, including a required data-processing contract, at section 59.1-579.
A 2026 amendment (S.B. 338, Ch. 820) added a ban on the sale of precise geolocation data, effective July 1, 2026 and already reflected in the codified text.
What it asks of an app
- Confirm you conduct business in Virginia, or produce a product or service used by Virginia residents, and process or sell personal data before relying on VCDPA's scope in compliance planning.
- Obtain a Virginia consumer's opt-in consent before processing sensitive data, and treat information a consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
- Do not sell precise geolocation data collected from Virginia residents. A 2026 amendment added an outright ban on that sale.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Virginia statute text, Title 59.1 Chapter 53, Code of Virginia