Law note · Virginia
Virginia Consumer Data Protection Act, consumer rights
VCDPA gives a Virginia consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, exercisable against the controller.
A controller must respond without undue delay and within 45 days of receipt, with one 45-day extension available, and must answer an appeal of a denial within 60 days, with an option to escalate to the Attorney General.
What it asks of an app
- Give a Virginia consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Virginia consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official Virginia statute text, Title 59.1 Chapter 53, Code of Virginia