Virginia Consumer Data Protection Act (VCDPA)

VCDPA, the first comprehensive state consumer privacy law in the country, defines personal data to exclude de-identified data and publicly available information, meaning information lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted it to a specific audience; this reaches most scraped public personal data outside VCDPA's coverage at the definitional level.

Enforcement is by the Attorney General exclusively; the Act expressly states that nothing in it shall be construed as providing the basis for, or be subject to, a private right of action. Two derived corpus candidates cite this Act as sections 59.1-571 to 59.1-585, which is wrong: section 59.1-571 is currently the definitions section of the unrelated Humane and Toxin-Free Cosmetics Act (Title 59.1, Chapter 52), and section 59.1-585 is a repealed placeholder.

VCDPA's actual current codification, confirmed directly against the official Virginia Law site, runs from section 59.1-575 (Chapter 53's own definitions section) to section 59.1-584 (its enforcement section); both derived candidates are folded into this instrument as describing the same Act under the wrong section numbers.

In 2026, the General Assembly reportedly passed and Governor Spanberger reportedly signed SB 338 (signed April 13, 2026, effective July 1, 2026, per contemporaneous legal commentary), replacing VCDPA's prior consent-based treatment of precise geolocation as sensitive data with an outright ban on selling a consumer's precise geolocation data; the primary SB 338 enrolled text was not independently read against the amended code section in this research, so its effective date and exact mechanism should be treated as reported rather than machine-verified.